[Cryptography] I don't get it.

[Bowness, Piers]

On Wednesday, April 16, 2014 9:43 AM, Sandy Harris <sandyinchina at gmail.com> wrote:

>On Tue, Apr 15, 2014 at 6:19 PM, Bowness, Piers <piers.bowness at rsa.com> wrote:
>> The ability to detect these types of issues is beyond a typical 
>> compiler's job; it cannot infer intent from the code being converted from language to machine code.
>>
>> Static analysis tools, OTOH, ...

>There are plenty of such tools available. Modern compilers are often better at this than older ones, especially if you enable the right options. Compiling with two or more different compilers is a good >check. So is running the code through one of lint(1)'s descendants.

That's exactly what modern static analysis tools are, "lint(1)'s descendants". No number of compilers or special options are going to analyze your application's flow like these new class of tools. 1977 is calling and wants its lint back.

> ... Require a clean compile with certain options and a clean run of lint

Yes. Integrating a modern static analysis tool into your continuous integration environment will provide the most benefit. They also provide interfaces to triage and record issue analysis between multiple developers. 

Disclaimer: I do not sell or develop static analysis tools, but consider them an integral part of our secure development methodologies.