41–50 of 58 posts
tl;dr: Ran static analysis tool author is trying to sell on a 1 million+ line code base for Amazon's open source game engine Lumberyard. Found warnings. Used it to infer quality of the product and wrote a very click-bait title.
They just bought it. Maybe the new team will clean up the code of Crytek?
The posts from these guys are pure BLACKMAIL. I work at one of the companies who's product they "reviewed" and many of us got unsolicited emails basically saying, we found all these bugs using our code analyzer. Buy a license from us to fix them or we will post a negative review of your code. It's a horrible business practice and they do that with many open source products. This behavior shouldn't be praised.
Maybe something got lost in translation? "Fix the bugs or we will publish" seems to be standard operating procedure for security researchers who randomly find a vulnerability. Maybe they just wanted to tell you that you'd be able to use their tool to fix those bugs more easily.
One thing that puzzles is me is why some of these checks aren't just part of the warnings that a compiler emits. I get that you wouldn't want to enable them all the time, but usually comparing a variable to itself is not what you want.
a.x = x;
a.y = y;
a.y = z; Earlier quoted context omitted.
Maybe something got lost in translation? "Fix the bugs or we will publish" seems to be standard operating procedure for security researchers who randomly find a vulnerability. Maybe they just wanted to tell you that you'd be able to use their tool to fix those bugs more easily.
The difference to me is whether they list all the bugs (while suggesting that their product would help) to the developer before publishing or not. If the only way to satisfy them is to pay, then it's incredibly scummy and moreover is a big disincentive for companies to open their source code. After all, every code base has bugs and I'm sure their developers were working on fixing bugs already, but only open source pr…
Earlier quoted context omitted.
REALLY disappointed to read this about The Wirecutter.
From context, Lams use of “kickbacks” in the email refers to Amazon affiliate payments. It’s a freakishly poor choice of words but hardly scandalous.
The optics of asking for that and after being denied changing the recommendation (presumably to something where they do get affiliate payouts) are quite bad.
That's a problem for the Wirecutter with products not available on Amazon: their (IMHO reasonable) argument has been that since they get the payout from a Amazon and not the individual vendors, they have no incentive to recommend a product that's not the best, since they get paid for whatever they recommend. This only works as long as everything tested is on Amazon. As soon as they start creating individual agreements with manufacturers, it becomes a lot less obvious that they can be trusted to not optimize for the most profitable affiliate terms. (Maybe there'd be something about having a policy that all agreements have to be the same, but that's tricky)
Earlier quoted context omitted.
The difference to me is whether they list all the bugs (while suggesting that their product would help) to the developer before publishing or not. If the only way to satisfy them is to pay, then it's incredibly scummy and moreover is a big disincentive for companies to open their source code. After all, every code base has bugs and I'm sure their developers were working on fixing bugs already, but only open source pr…
Developers of the project can write in support and ask for a full log for free.
tl;dr: Ran static analysis tool author is trying to sell on a 1 million+ line code base for Amazon's open source game engine Lumberyard. Found warnings. Used it to infer quality of the product and wrote a very click-bait title.
The funny thing is, the code wasn't even written by Amazon. They just bought it. Maybe the new team will clean up the code of Crytek?
Earlier quoted context omitted.
Developers of the project can write in support and ask for a full log for free.
In this case, they shouldn’t have to ask. If you’re going to provide a vulnerability report, provide a vulnerability report. Don’t dance around it to see if you can make money first.
Vulnerability != Weakness!