Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror

Slashdot videos: Now with more Slashdot!

  • View

  • Discuss

  • Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

×

Comment: Fortify SCA (Score 2) 88

by dougTheRug (#46413435) Attached to: Ask Slashdot: Reviewing 3rd Party Libraries?
in my day job I work for Fortify. You can contact the developers of this library and request that they use static analysis product on their software, or request a security review from a 3rd party. We would for sure catch those SQL injections and more. But we would need the original source code. You can probe for things from the binary, but the results don't come back in a way that is very actionable for the developers. As for your predicament: I think you would be better off writing your own library, rather than putting the insecure one to work.
Security

+ - Security review summary of NIST SHA-3 round 1-> 1

Submitted by
FormOfActionBanana
FormOfActionBanana writes "The security firm Fortify Software has undertaken an automated code review of the NIST SHA-3 round 1 contestants' (previously Slashdotted) reference implementations. After a followup audit, the team is now reporting summary results.

According to the blog entry, "This just emphasizes what we already knew about C, even the most careful, security conscious developer messes up memory management."

Of particular interest, Professor Ron Rivest's (the "R" in RSA) MD6 team has already corrected a buffer overflow pointed out by the Fortify review. Bruce Schnier's Skein, also previously slashdotted came through defect free."

Link to Original Source

The number of UNIX installations has grown to 10, with more expected. -- The Unix Programmer's Manual, 2nd Edition, June 1972

Working...