Answering questions about your code base – Part 1
Static analysis captures the current state of your code base and helps you answer key questions about the quality, security and maintainability of...

Golden rules of AST checker development
In my previous post, It’s time to create a custom checker…, we looked at the considerations involved in deciding which checker to create–AST...

It’s been a while since our last post, but we’ve been busy…
So it’s that time again, when our team finally gets to sleep for a day or two and get their lives back in order. What am I talking about? Answer:...

It’s time to create a custom checker, but what kind?
You’ve been using source code analysis on your integration build or your desktop, or (ideally) both. And then there’s “a situation”. The...

Security Issues with Apple iOS?
As a pretty avid Apple user (2 iPhones, 1 iPad2, iMac, iPod Touch, MacBook Pro, etc.), and the fact that I work in the business of software quality...

What’s the Right Iteration Length?
The question of “what’s the right iteration length” may not be as interesting as any of the questions found here (gum really doesn’t stay...

Compiler configuration
Compiler configuration is a problem with static analysis tools.  In the past, a static analysis (or source code analysis) tool simply worked by...

Is Pure Agile Always an Option?
Over the past few years I’ve talked to a number of customers in the embedded software and medical devices industries, and I continue to see a...

Microsoft banned function list
We have blogged before about software security guidelines, but there is one we haven’t discussed.  Several years ago Microsoft published the...

Secure Coding eLearning Resource
One of the common challenges we hear from customers regarding their software security assurance programs is developer education. Sure, there are...