Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcoming Semmle to GitHub

github.blog

Post reply on HN
Print view View original

11–20 of 110 posts

Re: Welcoming Semmle to GitHub

#11

Post by troydavis »

chuckgreenman wrote: post #3

Interesting to see the differences between Github and Gitlab's strategy in this arena. Github appears to be going the aqui-hire route with Semmle, dependabot, pullpanda etc, where as I don't think Gitlab's made an acquisition for a year or two.

GitLab published what they're interested in: https://about.gitlab.com/handbook/acquisitions/. It's an amazing, one-of-a-kind doc. One of their constraints (https://about.gitlab.com/handbook/acquisitions/#what-we-offe...) is quite limiting, though:

> The total purchase price of the deal, paid in cash, will not exceed $1M and will be the total and only compensation for the entire deal.

Re: Welcoming Semmle to GitHub

#12

Post by _xnmw »

I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.

Re: Welcoming Semmle to GitHub

#13

Post by javagram »

_xnmw wrote: post #12

I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.

To be fair, if a “parent corporation” is a thing, then logically it has children and can be a corporate family.

Re: Welcoming Semmle to GitHub

#14

Post by _xnmw »

javagram wrote: post #13
_xnmw wrote: post #12

I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.

To be fair, if a “parent corporation” is a thing, then logically it has children and can be a corporate family.

Intent matters. The phrase "parent corporation" has no PR or emotional intent. "Welcoming X to Y family" has a clear emotive intent.

Re: Welcoming Semmle to GitHub

#15

Post by pja »

Github has been really working on their source code analysis toolkit recently & this acquisition makes perfect sense as part of that strategy. Congratulations to Oege & the team.

Re: Welcoming Semmle to GitHub

#16

Post by Dirlewanger »

javagram wrote: post #13
_xnmw wrote: post #12

I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.

To be fair, if a “parent corporation” is a thing, then logically it has children and can be a corporate family.

Welp, guess it's time to bust out the "I'm offended and we need to change this lingo" card because corporations aren't people and we should stop referring to them that way

Re: Welcoming Semmle to GitHub

#17

Post by prepend »

leblancfg wrote: post #9
claytonjy wrote: post #7

Earlier quoted context omitted.

Gitlab hasn't generally seemed interested in these sorts of free scanning tools. I wonder if that's because their users are much more weighted towards private/self-hosted than Github's are? Because so little open source happens on Gitlab, they can't buy good PR through this kind of strategy like Github can.

I've been looking quite a bit into this recently, and even though they might not be screaming it from the rooftops, Gitlab offers quite a few security-related features. There are code scanning, dependency tracking, etc. features at various levels of readiness. https://about.gitlab.com/devops-tools/ https://about.gitlab.com/stages-devops-lifecycle/secure/

They’ve had SAST tools for a few releases, but high up in the paid license types. With GitHub providing for free, they may need to move them into CE.

Re: Welcoming Semmle to GitHub

#18

Post by andyljones »

chuckgreenman wrote: post #3

Interesting to see the differences between Github and Gitlab's strategy in this arena. Github appears to be going the aqui-hire route with Semmle, dependabot, pullpanda etc, where as I don't think Gitlab's made an acquisition for a year or two.

Microsoft has $130bn cash-on-hand.

The surprise is really that they're not being more aggressive in their acquisitions.

Re: Welcoming Semmle to GitHub

#19

Post by DannyBee »

sneak wrote: post #5
DannyBee wrote: post #4

Earlier quoted context omitted.

Semmle is basically datalog over source code. For what it works for, it works nice. But it is not a pancaea. Security vulnerability finding is almost certainly the wrong target for Semmle - I am unsure why they are trying to push that angle. There are much better stories in things like refactoring and understanding. (I say this having overseen a number of deployments for various reasons, some successful, some not)

Nothing is a panacea. Things that help move the needle without requiring tons of time or effort are useful and valuable. I'm really glad to see more efforts in this area.

While it's true that there is no pancaea, Semmle will not move the needle on vulnerability finding. This I have extensive data on.

(I mean this in terms of capability, not sudden popularity)

It would move the needle on a bunch else. It is a good tool for sure (and im very happy for them), i just think they will disappoint people by pressing this particular narrative, and wouldn't do so with a different narrative

Re: Welcoming Semmle to GitHub

#20

Post by andrewprock »

troydavis wrote: post #11
chuckgreenman wrote: post #3

Interesting to see the differences between Github and Gitlab's strategy in this arena. Github appears to be going the aqui-hire route with Semmle, dependabot, pullpanda etc, where as I don't think Gitlab's made an acquisition for a year or two.

GitLab published what they're interested in: https://about.gitlab.com/handbook/acquisitions/ . It's an amazing, one-of-a-kind doc. One of their constraints ( https://about.gitlab.com/handbook/acquisitions/#what-we-offe... ) is quite limiting, though: > The total purchase price of the deal, paid in cash, will not exceed $1M and will be the total and only compensation for the entire deal.

They are looking at companies that: "Raised under $10M total investment funds, last round being over 3 years ago"

This implies that in addition to self-funded ventures, they are looking for fire sales from failed start-ups.

Post reply on HN