Java Coders Team to Bug-Hunt
525033
Fortify, FindBug launch open-source project to share analysis and tools.
431277
The Zend Developer Zone (and Zend) are running a new contest where you could win yourself a free copy of their popular Zend Studio IDE.   It's a very poorly kept secret that Zend is working on the next generation of Zend Studio. They must be getting down to the 'fit and finish' pieces of the project because my buddy Yossi wrote me and asked me to enlist the help of the PHP community at large. So here's his request. The Zend Studio team needs your help. They are looking for a code snippet to showcase the syntax highlighting and debugging capabilities of Zend Studio.    They're looking for certain types of code snippets and a list of the criteria are included in the ZDZ post. The deadline's at at midnight (Pacific) on July the 26th, so get those snippets together and get them sent off for your chance to win!
311136
(InfoWorld) - Security experts working on the CWE (Common Weakness Enumeration) project claim that the initiative to create a central resource of software vulnerabilities for developers is gaining momentum. Sponsored by the Department of Homeland Security (DHS) and maintained by a team of workers at nonprofit Mitre and other security professionals, the ongoing effort is roughly four months shy of publishing a final draft of its vulnerability encyclopedia, said leaders of the project. Presenting at the ongoing Black Hat 2007 conference, CWE initiative leaders said they are busy aggregating and organizing the mountains of vulnerability data they have gathered and said they are working more closely than ever with applications security testing companies to help compare the abilities of various software scanning tools. Launched in Dec. 2005, CWE seeks to establish a unified, measurable set of software flaws to help developers improve the quality of their products and drive out the types of vulnerabilities that have led to the ongoing malware explosion. By gathering input on commonly seen mistakes from developers, researchers, and security vendors, the group believes it can create a common language and standard procedures for handling the many different types of loopholes that exist in programs' source code today. Prior to the delivery of a final draft of its encyclopedia of flaws later this year, CWE officials said they are preparing a sixth iteration of the index to likely be published some time in April. While much of the work the group has completed thus far has revolved around the gathering of vulnerability formats and the various methods used to identify and remediate the coding problems, the project has recently involved a significant amount of testing of security scanning tools to get a better idea of the capabilities and limitations of those products. By gaining an understanding of the vulnerabilities that popular code scanning engines can find --Â and those they can't --Â CWE can help developers understand the types of issues they will need to look for on their own, said Bob Martin, a CWE leader and the head of Mitre's related CVE (Common Vulnerability Exposures) Compatibility effort. "We wanted to evaluate what the tools claim to cover and what they are most effective at finding," Martin said. "Right now, best test is to throw tools at a big pile of code and see what tools find the most vulnerabilities, but we're changing that paradigm into test cases where we now look at the answers so we can evaluate what the tools found and what kinds of complexities they can handle." CWE's research will not list the names and performance results of the products it is testing -- provided by over 20 firms, including Cenzic, Fortify, SPI Dynamics, Veracode, and Watchfire -- but the work to compile a resource that offers developers an idea of the types of vulnerabilities missed by the tools should provide a great deal of value, Martin said. Officials with the project said that they have been pleasantly surprised by the variety of methods employed by the commercial scanning tools and the different types of flaws found by the various products. Going into this phase of the research, the group expected to find that many scanning systems identified the same types of issues, said Sean Barnum, director of knowledge management at Cigital, a software quality assurance company. The tests also revealed that the products were looking for only 45 percent of the 600 common vulnerabilities that have already been entered into the CWE index. "We found that less than half of what we already have in CWE is covered by these tools, so this helps prove that there are a lot of known issues out there that aren't being addressed," Barnum said. "We also thought that the tools would look for the same types of things, but they are actually very different, and there's not a lot of overlap; that's something that developers need to be aware of as they choose tools; you want to right set for aggregated coverage." Before each release of CWE, workers with the project spend much of their time comparing all the vulnerability definitions and mitigation taxonomies in the index, attempting to refine the language used in the descriptions and add real-world examples of attacks that target the flaws. That work is continuing and will remain the primary focus of CWE's efforts going forward, officials said, including work to de-emphasize nomenclature that describes common problems based on the attack methods used to exploit them. Barnum said that at this point, the encyclopedia isn't as polished as it might be, but he observed that he and other project organizers believe that taking an all-inclusive approach is the best strategy for expanding the resource at this point. "It's still a kitchen sink approach, but that's a smart approach," Barnum said.
745683
How a simple bug betrays Microsoft's disdain for basic best practice principles
118719
InfoWorld - An Eclipse IDE plug-in that would provide search capabilities specifically for developers is being readied by a University of California, Berkeley computer science professor.
97191
A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows. The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems.
568284
Everyone in the PHP community (as is probably true all around the web) is buzzing about the new offering from Google - the Google Code Search. In the PHP community, the ones talking about it so far include:  Chris Shiflett's look at the security aspect of the search Ilia Alshanetsky's take on the search as it possibly being a hacker's good friend Pierre-Alain Joye's searches for macros and the term "virtual_file_ex" Harry Fuecks' own search for superglobal-related issues Ivo Jansch's happy look into frustrations other developers have had (ex. this search)    Check out this handy tool and see what you think. Does it provide too much access to code that needs to stay out of hacker's hands? Or does it promote the "open" in open source better than most of the tools out there?
536359
DECEMBER 03, 2004 (IDG NEWS SERVICE) - WASHINGTON - Software vendors need automated tools that look for bugs in their code, but it may be a decade before many of those tools are mature and widely used, said the former director of cybersecurity for the US
737544
Over on Marco Tabini's Weblog today, there's a new posting that might hit close to home with quite a fe developers out there - a discussion on code documentation.
718475
Wow... this looks  like a cool feature:  I'm being more and more impressed with JDK 1.5.  I tend to be really conservative with software upgrades but this just looks plain cool:  "jstack prints Java stack traces of Java threads for a given Java process or core file or a remote debug server. For each Java frame, the full class name, method name, 'bci' (byte code index) and line number, if available, are printed. With the -m option, jstack prints both Java and native frames of all threads along with the 'pc' (program counter). For each native frame, the closest native symbol to 'pc', if available, is printed. C++ mangled names are not demangled. To demangle C++ names, the output of this comman ...
620094
roundup Free-roaming source code breeds new Netsky pest. Also: From IE to Opera, browsers are a likely prey.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
451786
It hopes to have about 5 million testers checking out latest version of Windows update, as it tries to stamp out bugs.
139275
Popular posts from PHPDeveloper.org for the past week:PHP-Coding-Practices.com: Try-Catch Syntax WeirdnessPHPBuilder.com: Cross-Platform Database PHP DevelopmentIBM developerWorks: Java and PHP technology on AIX - Integrate the Java business application w/ DB2OpenSourceCommunity.org: What do you think makes a good CMS?Jonathan Snook's Blog: Elemental: Conditional Content with CakePHPDevShed: The Basics of Using the Factory Pattern in PHP 5Builder.com.au: PHP exploit code plants itself in GIFJohn Cox's Blog:  Linux.com Now PHP PoweredNick Halstead's Blog: Solving Programming ProblemsPHP-Tools Blog: Testing FIT
51437
eEye Digital Security has alerted Microsoft's bug team about a remote code vulnerabilityin Office 2007. Microsoft confirmed that  it's looking into the report.
568430
Developer launches a Month of PHP Bugs project with 11 bugs in five days.
412006
From PHP Planet today, there's a note on Marcus White's weblog stating that: you cannot prove anything by testing. No matter how hard you try, there could always be something wrong, or some combination of conditions or some external event that you havenÃ¢ÂÂt thought of. You never know absolutely for sure that your project is working correctly and you never will.