|
I see. So, maybe OWASP is not the right term for what I need. I'll look into static code analysis.
Thanks.
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
No, that's correct. OWASP is the organization that is dedicated to web security, and their top 10 are based on the most common vulnerabilities seen in the wild.
The problem is that, generally, vulnerabilities can be difficult to identify from static (not currently executing) code. Some are obvious, like SQL injection, but most are not so easy to identify unless an application is actively executing, like MitM attacks or exploits that are based on malformed packets. You won't see these until they are used against your application, which is exactly what ZAP does.
"Never attribute to malice that which can be explained by stupidity."
- Hanlon's Razor
|
|
|
|
|
Got it. That makes sense.
Thanks. Very helpful.
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
|
It looks like Black Duck helps you manage which Open Source projects you are using in your code. I didn't see anything that said it can scan your own code looking for issues. Perhaps I missed it?
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
we use AppScan and Klocwork, for our static scans.
|
|
|
|
|
|
If you're using .NET, for static analysis you can take a look at PumaScan[^] or Security Code Scan[^]. Both are open source. Security Code Scan has better support for .NET Core.
OWASP maintains a list of code analysis tools here[^].
|
|
|
|
|
Thanks. 
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
Is a hurricane report just a rough draft?
Sent from my Amstrad PC 1640
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
well blow me down, that one was almost sensible.
This internet thing is amazing! Letting people use it: worst idea ever!
|
|
|
|
|
Eye don't know weather you are under a lot of stress but it appears that a low pressure environment would be swell for you.
Socialism is the Axe Body Spray of political ideologies: It never does what it claims to do, but people too young to know better keep buying it anyway. (Glenn Reynolds)
|
|
|
|
|
I eye'd that comment and saw it could be improved just a bit cycloned it, below,
Cloned for this FIFY:OriginalGriff wrote: Is a hurricane report just a rough draft?
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
Nice to see you re-gale us with this thought, you may see a surge in up votes leading to a flood of rep points.
"the debugger doesn't tell me anything because this code compiles just fine" - random QA comment
"Facebook is where you tell lies to your friends. Twitter is where you tell the truth to strangers." - chriselst
"I don't drink any more... then again, I don't drink any less." - Mike Mullikins uncle
|
|
|
|
|
I don't want to cloud the argument, but I fear it'll be a cold day in hale before I agree to that.
/ravi
|
|
|
|
|
I can't see what precipitated that response, are you cirrus?
"the debugger doesn't tell me anything because this code compiles just fine" - random QA comment
"Facebook is where you tell lies to your friends. Twitter is where you tell the truth to strangers." - chriselst
"I don't drink any more... then again, I don't drink any less." - Mike Mullikins uncle
|
|
|
|
|
No, of course not. Darn, you stole my thunder.
/ravi
|
|
|
|
|
I breezed through The Lounge earlier and missed this post.
|
|
|
|
|
You're trying to wind us up now, aren't you...
|
|
|
|
|
There is justice after all!
(Now can they prove a couple of fags with a pint at the end of a day is also good for you?  )
|
|
|
|
|
Based upon the CP definition of moderate drinking, I suggest you reanalyze the interpretation so that it includes waking up in the morning, remembering nothing of the night before, and thus not forgetting anything, either.
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
Dont know about COP by my idea of moderate is a but off the scale!
I got pulled by the cops last friday after drinking 5 pints of ale (~4.55 stuff). (This was probably about 2 hours after my last drink.) I blew 15 (fail is 35).
|
|
|
|
|
If you use the same scale as in the US (if 15 == 0.15% BAC) then you'd be twice the legal limit for driving while intoxicated.
From what I remember of Paris, irrational swerving whilst driving may end up being a safety feature, perhaps explaining the higher levels.
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
So do you think we use the same scale then?
|
|
|
|
|
so it should be done as often as possible.
might even make you smarter!
This internet thing is amazing! Letting people use it: worst idea ever!
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
