4 ms·
Very simple: implement language-specific static analysis backends and a general frontend and vuln management. Just like every Linux distribution does distribut
by goodpoint 4y ago
Very simple: implement language-specific static analysis backends and a general frontend and vuln management.
Just like every Linux distribution does distributes packages and manages security in a language-agnostic way. Nothing new.
Amazing how people here dismissed my point by downvoting and providing no reasoning.
- klysm 4y ago> language-specific static backends I guess it sounded like you meant a general solution that wasn’t language specific. I’m still not sure if there’s an abstraction you could use to make language aspects marked as vulnerable - the semantics between languages are just so varied. Anyway we need the language specific ones first.
- goodpoint 4y ago> Anyway we need the language specific ones first. No, we have language-agnostic vuln management since decades and a good tool could use a fall back to the traditional method when a language-specific backend is not available.
- klysm 4y agoI mean language agnostic vuln management that’s capable of marking a particular subset of functionality as vulnerable like this is.