[email protected] spake unto us the following wisdom: > Just wondering if your development team had ever entertained the > thought of submitting your source code for a static code analysis by > Fortify. It is free of charge and can be a source validation for any > disputes on potential vulnerabilities, as well as a means of ensuring > that your code is secure in other ways than a code walk-through or > peer review.
Pidgin has been scanned by a number of automated security scanners over the years, I am not sure off the top of my head whether Fortify is one of them. > Our organization had a request to introduce your application into our > environment, which, in part, was rejected because of the inability to > scan the source code because there were snippets of some languages > that we did not license for with Fortify. You should be able to validate the important parts of Pidgin functionality by scanning *only* C language files. I'm not sure what you did not have a license for, but the only non-C language sources which are actually linked to Pidgin are plugin loaders which can be trivially disabled at compile time (Perl, Tcl, and Mono (C#)). There are Python, shell, and possibly other sources which are used only for build-time issues, and their security need not be validated for deployment (provided you are not validating the build process, and I don't know why you would). Ethan
signature.asc
Description: Digital signature
_______________________________________________ [email protected] mailing list Want to unsubscribe? Use this link: http://pidgin.im/cgi-bin/mailman/listinfo/support
