Sicurezza applicativa: analisi statica del codice sorgente di software FOSS

Due grandi della Sicurezza Applicativa riflettono sulla valenza della SCA, "Static Code Analysis" e sull'utilizzo di strumenti che la implementano:

Gary McGrew: On Open Source

(...)
Firstly, I am a big fan of code scanning and believe that use of static
analysis tools should always be one of the basic security steps integrated into
every SDLC.
However, there are huge problems with declaring security after passing a
code scan with an arbitrary tool and a random set of rules.
The most obvious issue is that security defects come in two flavors—bugs
and flaws—each accounting for roughly 50% of defects in practice.
Code scanning tools can only find bugs. Here are two stupid examples for
effect: can a code scanning tool determine that no user authentication was
performed? How about whether or not a playback attack will work?
(...)

Michael Howard: "Open-source projects certified as secure" – huh?

(...)

So we finally have the security silver bullet!
Run this tool on your
code, fix the bugs, and you’re secure (and maybe unbreakable?!) I don’t think
so.
There are three big problems with this line of thought:

First, the security bugs found are only the security bugs found by the tool,
and that list is always smaller than the list of all bugs.

Second, it assumes that any new code or code changes are bug free. Which may
or may not be true. In my experience, it is rarely true that new code is utterly
bug free if you don’t take a holistic, process-oriented view to security.

Third, and this is probably the most important, at best the tool understands
a subset of today’s vulnerabilities; that could all change tomorrow when a new
class of vulnerability or a subtle variant is found.

(...)