Can We Trust the Libraries We Use?
viva64.com
Can We Trust the Libraries We Use?
1–10 of 55 posts
Re: Can We Trust the Libraries We Use?
#2Do you have a choice?
Re: Can We Trust the Libraries We Use?
#3I hope so
Re: Can We Trust the Libraries We Use?
#4Of course you can not trust them. Just look at OpenSSL. If you truly need "safety critical" there are no shortcuts.
Re: Can We Trust the Libraries We Use?
#5Code coverage and static analysis are such valuable tools, I can't believe they are not used more and more frequently .. it really seems that a lot of open source projects would benefit from a coverage/analysis phase on checkin.
Re: Can We Trust the Libraries We Use?
#6Code coverage and static analysis are such valuable tools, I can't believe they are not used more and more frequently .. it really seems that a lot of open source projects would benefit from a coverage/analysis phase on checkin.
It seems that Coverity[0] is offering free static analysis to open source projects. Even if it is a marketing move, it will benefit the open source ecosystem in the long run. You'll waste some time analyzing false positive defects, the handful of critical/security error found make it worth it in my opinion. Notably the duplicate "goto fail" in one of the recent apple vulnerability should have triggered the dead code detection.
Re: Can We Trust the Libraries We Use?
#7Depends where they come from. The average Python or Perl library seems better written and more tested that something I would write myself. JavaScript seems to have a lot less quality in my experience.
Re: Can We Trust the Libraries We Use?
#8Code coverage and static analysis are such valuable tools, I can't believe they are not used more and more frequently .. it really seems that a lot of open source projects would benefit from a coverage/analysis phase on checkin.
It seems that Coverity[0] is offering free static analysis to open source projects. Even if it is a marketing move, it will benefit the open source ecosystem in the long run. You'll waste some time analyzing false positive defects, the handful of critical/security error found make it worth it in my opinion. Notably the duplicate "goto fail" in one of the recent apple vulnerability should have triggered the dead code…
The PVS-Studio team also does a great job: http://www.viva64.com/en/a/0084/
Re: Can We Trust the Libraries We Use?
#9Test the hell out of anything you use, both hardware, software, and infrastructure -- and write the tests before you write any code. Double-down on that for stuff like medical tech.
Now, is anybody doing that? Anybody? (Sound of crickets chirping)
Re: Can We Trust the Libraries We Use?
#10Typically you test your software to your needs. If there's a bug in a library you use it would show up when testing your code that uses the library.