Viewing profile — stephen-magill

I think that works provided the cadence isn't too slow. We see an average of 8 to 12 project versions per year being published depending on ecosystem. That matches nicely with the …

This is something we studied in last year's report. Based on a survey similar to the one described in Chapter 4 we found that a mix of features measuring participation in the open …

This is exactly right. Low MTTU and keeping up-to-date across the transitive dependency tree makes it less likely that vulnerabilities creep in due to those transitive dependencies…

Yep. The question is whether the engineering trade-offs are worth it. Less-used libraries might have more undiscovered bugs that crop up in production and could have lower levels o…

We closely monitor the "fix rate" -- what percentage of issues reported by Lift are ultimately fixed by developers. If the fix rate for a particular tool or type of rule is too low…

We provide deeper analysis and can surface things like thread safety issues and resource leaks. We also focus very closely on ensuring our tools have low false positive rates and s…

We do support Python. Here's an example of a Python scan: https://lift.sonatype.com/result/smagill-lift-demo/posthog/0... That gives an idea of the sorts of results we flag in Pyth…