Subject: FreeBSD vs automated code-checking
To: None <netbsd-advocacy@netbsd.org>
From: Stephen Borrill <netbsd@precedence.co.uk>
List: netbsd-advocacy
Date: 06/29/2005 09:19:09
Extract from:
http://www.theregister.co.uk/2005/06/29/coverity_analyses_freebsd_for_flaws/
On Tuesday, code-analysis software maker Coverity announced that its
automated bug finding tool had analyzed the community-built operating
system FreeBSD and flagged 306 potential software flaws, or about one
issue for every 4,000 lines of code. The tool, which identifies certain
types of programming errors, has previously been used to find flaws in
other open-source software, including the Linux kernel and the MySQL
database.
The low number of flaws found by the system underscores that FreeBSD's
manual auditing by project members has reduced the vulnerabilities in the
operating system, said Seth Hallem, CEO of Coverity.
"FreeBSD - as well as OpenBSD and NetBS (sic) - are small communities
which have made it a priority to build security into the operating system,
and that has paid dividends," Hallem said.
FreeBSD is the latest open-source project to benefit from being run
through its paces by code-checking software. Last year, Coverity's tools
found 950 potential flaws in version 2.6.9 of the Linux kernel, 97
potential flaws in the MySQL database code, and 26 potential flaws in the
Berkeley DB code. Moreover, the tool has analyzed the code for OpenBSD,
with any flaws found submitted back to the project, according to OpenBSD
members.
--
Stephen