Earlier quoted context omitted.
This would make sense since Semmle would likely need access.
I'd be ready to put money on the fact that GitHub has access to all repositories, even private ones!
[deleted]
Welcoming Semmle to GitHub
41–50 of 110 posts
Re: Welcoming Semmle to GitHub
#42Earlier quoted context omitted.
Semmle does not scale, both in terms of their index design and their overall system design. This makes it poorly suited for truly global program properties and much better suited for things like refactoring.
It's being run frequently across the entire Windows OS repo. I have heard there is more work to be done to make it scale better, but it can scale.
Am Microsoft.
Mountains were moved to make it scale, but that has been achieved. Semmle can scale with work - it just takes a lot of effort and code.
Re: Welcoming Semmle to GitHub
#43> Human progress depends on the open source community. (Non native speaker here). Am I misunderstanding something, or is the author explaining that humanity can not progress without the open source community?
As the other comments point out, it's hyperbole. It's also an aspirational statement.
Aspirational, as in, they wish that github would be the key factor in human progress. Maybe I can say that even plainer: to the leadership at github, the progress of the human race depends on github.
The open source community depends on github.
That's what it's implying.
(The reader is left to identify that as wishful thinking.)
Re: Welcoming Semmle to GitHub
#44Interesting to see the differences between Github and Gitlab's strategy in this arena. Github appears to be going the aqui-hire route with Semmle, dependabot, pullpanda etc, where as I don't think Gitlab's made an acquisition for a year or two.
Microsoft has $130bn cash-on-hand. The surprise is really that they're not being more aggressive in their acquisitions.
They should be like Yahoo was and buy everything they see? (for billions, only to sell it at a massive loss later)
I've not heard from Yahoo in a year at least, do they still exist ...
Re: Welcoming Semmle to GitHub
#45I spent way too long thinking that Semmie was just a badass programmer
Re: Welcoming Semmle to GitHub
#46Earlier quoted context omitted.
Microsoft has $130bn cash-on-hand. The surprise is really that they're not being more aggressive in their acquisitions.
They should be like Yahoo was and buy everything they see? (for billions, only to sell it at a massive loss later) I've not heard from Yahoo in a year at least, do they still exist ...
I just got an email from Yahoo about a settlement in a class action lawsuit over a massive data breach. It said something about Yahoo paying for 2 years of credit monitoring service to anyone affected by the breach.
Maybe that's not exactly what you were looking to "hear from" Yahoo about, though...
Re: Welcoming Semmle to GitHub
#47Earlier quoted context omitted.
Nothing is a panacea. Things that help move the needle without requiring tons of time or effort are useful and valuable. I'm really glad to see more efforts in this area.
While it's true that there is no pancaea, Semmle will not move the needle on vulnerability finding. This I have extensive data on. (I mean this in terms of capability, not sudden popularity) It would move the needle on a bunch else. It is a good tool for sure (and im very happy for them), i just think they will disappoint people by pressing this particular narrative, and wouldn't do so with a different narrative
The Datalog part is interesting! Do they have a bunch of rules to make graph queries work nicely, like Datomic pull syntax or maybe some pattern matching syntactic sugar? Is the underlying thing still an EAVT store? Is any of that information publicly available?
Re: Welcoming Semmle to GitHub
#48The linked blog post [0] and the new security marketing page [1] both have a little more detail on what this actually means. Basically, Semmle offers a static analysis tool that operates on your source code as a graph (from what I understand) and points out bugs and security holes in your code. Github is now offering that for free on repos at all tiers. [0] https://github.blog/2019-09-18-securing-software-together/ […
The funny thing is I was working on a pitch to get Atlassian to buy them so they don't end up in Microsoft's hands. I thought integration with a repo company would be good since they could cross-sell it for code understanding and maintenance. Then I see this article. (sighs) At least I got it right on the type of company that would grab them. I'd push something else for security, though, to complement it. RV-Match is…
Why would Atlassian be better?
Re: Welcoming Semmle to GitHub
#49I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.
When I read the headline I assumed it meant that GitHub was hiring an employee named Semmle, which confused me until I realized Semmle was a business.
Re: Welcoming Semmle to GitHub
#50The linked blog post [0] and the new security marketing page [1] both have a little more detail on what this actually means. Basically, Semmle offers a static analysis tool that operates on your source code as a graph (from what I understand) and points out bugs and security holes in your code. Github is now offering that for free on repos at all tiers. [0] https://github.blog/2019-09-18-securing-software-together/ […
Semmle is basically datalog over source code. For what it works for, it works nice. But it is not a pancaea. Security vulnerability finding is almost certainly the wrong target for Semmle - I am unsure why they are trying to push that angle. There are much better stories in things like refactoring and understanding. (I say this having overseen a number of deployments for various reasons, some successful, some not)
You’re wrong on that, security teams at the major tech companies love it, especially for variant analysis. Ask your coworkers at Google! One of which recently left to become Semmle’s Chief Security Officer.