Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcoming Semmle to GitHub

github.blog

Post reply on HN
Print view View original

21–30 of 110 posts

Re: Welcoming Semmle to GitHub

#21

Post by tensor »

eatonphil wrote: post #2

The linked blog post [0] and the new security marketing page [1] both have a little more detail on what this actually means. Basically, Semmle offers a static analysis tool that operates on your source code as a graph (from what I understand) and points out bugs and security holes in your code. Github is now offering that for free on repos at all tiers. [0] https://github.blog/2019-09-18-securing-software-together/ […

Am I reading that right that it's only on public repositories though? For private repositories I guess you have to buy through Semmle directly (via call us pricing)?

Re: Welcoming Semmle to GitHub

#22

Post by UncleMeat »

sneak wrote: post #5
DannyBee wrote: post #4

Earlier quoted context omitted.

Semmle is basically datalog over source code. For what it works for, it works nice. But it is not a pancaea. Security vulnerability finding is almost certainly the wrong target for Semmle - I am unsure why they are trying to push that angle. There are much better stories in things like refactoring and understanding. (I say this having overseen a number of deployments for various reasons, some successful, some not)

Nothing is a panacea. Things that help move the needle without requiring tons of time or effort are useful and valuable. I'm really glad to see more efforts in this area.

Semmle does not scale, both in terms of their index design and their overall system design. This makes it poorly suited for truly global program properties and much better suited for things like refactoring.

Re: Welcoming Semmle to GitHub

#23

Post by striking »

Dirlewanger wrote: post #16
javagram wrote: post #13

Earlier quoted context omitted.

To be fair, if a “parent corporation” is a thing, then logically it has children and can be a corporate family.

Welp, guess it's time to bust out the "I'm offended and we need to change this lingo" card because corporations aren't people and we should stop referring to them that way

I mean, in all seriousness, aren't they a little bit like people? https://www.npr.org/2014/07/28/335288388/when-did-companies-...

Re: Welcoming Semmle to GitHub

#24

Post by hanniabu »

tensor wrote: post #21
eatonphil wrote: post #2

The linked blog post [0] and the new security marketing page [1] both have a little more detail on what this actually means. Basically, Semmle offers a static analysis tool that operates on your source code as a graph (from what I understand) and points out bugs and security holes in your code. Github is now offering that for free on repos at all tiers. [0] https://github.blog/2019-09-18-securing-software-together/ […

Am I reading that right that it's only on public repositories though? For private repositories I guess you have to buy through Semmle directly (via call us pricing)?

This would make sense since Semmle would likely need access.

Re: Welcoming Semmle to GitHub

#26

Post by throwaway744678 »

hanniabu wrote: post #24
tensor wrote: post #21

Earlier quoted context omitted.

Am I reading that right that it's only on public repositories though? For private repositories I guess you have to buy through Semmle directly (via call us pricing)?

This would make sense since Semmle would likely need access.

I'd be ready to put money on the fact that GitHub has access to all repositories, even private ones!

Re: Welcoming Semmle to GitHub

#27

Post by networkimprov »

throwaway744678 wrote: post #25

> Human progress depends on the open source community. (Non native speaker here). Am I misunderstanding something, or is the author explaining that humanity can not progress without the open source community?

That's the meaning I took from it (USA native).

Re: Welcoming Semmle to GitHub

#28

Post by mytailorisrich »

_xnmw wrote: post #12

I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.

It actually took me a while to understand that the announcement likely meant that they had acquired Semmle...

Re: Welcoming Semmle to GitHub

#29

Post by mytailorisrich »

throwaway744678 wrote: post #25

> Human progress depends on the open source community. (Non native speaker here). Am I misunderstanding something, or is the author explaining that humanity can not progress without the open source community?

That's right. That's called hyperbole (with a 'e').

Re: Welcoming Semmle to GitHub

#30

Post by andyfleming »

_xnmw wrote: post #14
javagram wrote: post #13

Earlier quoted context omitted.

To be fair, if a “parent corporation” is a thing, then logically it has children and can be a corporate family.

Intent matters. The phrase "parent corporation" has no PR or emotional intent. "Welcoming X to Y family" has a clear emotive intent.

Maybe the intent of the writer was to make the new hires feel welcome aboard to their new company.

That's also not mutually exclusive of the emotive intent you are describing. What makes that Orwellian though?

Post reply on HN