{"id":126,"date":"2008-05-23T07:07:38","date_gmt":"2008-05-23T15:07:38","guid":{"rendered":"http:\/\/jaredrobinson.com\/blog\/?p=126"},"modified":"2009-07-11T04:15:04","modified_gmt":"2009-07-11T04:15:04","slug":"open-source-security-report-from-coverity","status":"publish","type":"post","link":"https:\/\/jaredrobinson.com\/blog\/open-source-security-report-from-coverity\/","title":{"rendered":"Open Source Security report from Coverity"},"content":{"rendered":"<p>[Coverity](http:\/\/www.coverity.com) has published it&#8217;s [Open Source Scan Report 2008](http:\/\/coverity.com\/library\/pdf\/Coverity-Scan_Open_Source_Report_2008.pdf), which details the security status of several open source projects. Here&#8217;s my summary:<\/p>\n<p>* The overall security of open source projects is improving.<br \/>\n* There&#8217;s a linear relationship between the amount of code and the amount of bugs.<br \/>\n* Surprisingly, there&#8217;s no relation between function length and defect density.<\/p>\n<p>Projects with exceptionally low defect density include Amanda, NTP, OpenPAM, OpenVPN, Perl, PHP, Python, TCL, Postfix, Samba, curl, libvorbis and vim.<\/p>\n<p>The top two security defects are<\/p>\n<p>1. NULL pointer dereference<br \/>\n2. Resource leak<\/p>\n<p>I got to preview [Coverity Prevent](http:\/\/www.coverity.com\/html\/prod_prevent.html) at a previous job, and it rocks at finding real bugs in code, with a very low rate of false positives.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[Coverity](http:\/\/www.coverity.com) has published it&#8217;s [Open Source Scan Report 2008](http:\/\/coverity.com\/library\/pdf\/Coverity-Scan_Open_Source_Report_2008.pdf), which details the security status of several open source projects. Here&#8217;s my summary: * The overall security of open source projects is improving. * There&#8217;s a linear relationship between the amount of code and the amount of bugs. * Surprisingly, there&#8217;s no relation between function length &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/jaredrobinson.com\/blog\/open-source-security-report-from-coverity\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Open Source Security report from Coverity&#8221;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,16,17],"tags":[],"class_list":["post-126","post","type-post","status-publish","format-standard","hentry","category-linux","category-security","category-tech"],"_links":{"self":[{"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/posts\/126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/comments?post=126"}],"version-history":[{"count":1,"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/posts\/126\/revisions"}],"predecessor-version":[{"id":390,"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/posts\/126\/revisions\/390"}],"wp:attachment":[{"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/media?parent=126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/categories?post=126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jaredrobinson.com\/blog\/wp-json\/wp\/v2\/tags?post=126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}