This blog post starts out with some truth: 1. 3rd party binary static analysis is not industry standard devolves to half truths: 2. the amount of vendors doin

This blog post starts out with some truth: 1. 3rd party binary static analysis is not industry standard devolves to half truths: 2. the amount of vendors doing static analysis for security is not what I would really call "Many" 3. You're probably not going to get good ROI from a static analysis tool. But you might reduce your risk significantly by not buying Oracle. And then devolves into pure bullshit (4, 5, 6, 7) But despite the fact that Mary Ann Davidson seems to have a much greater interest in hiding Oracle's issues from everyone, rather than actually fixing them, the attempt to get 3rd party binary static analysis mandated is clearly Veracode attempting some good ol' fashioned regulatory capture. Customers really should have the right to attempt binary static analysis on their vendor's software, but mandating that companies use one niche, specific technique supported by very few vendors to achieve a broad goal is total bullshit. Also, Coverity was bought by Synopsis, not IBM like the post claims.