2 ms·
Are there SAST or linting tools to check that the code is compliant with the [agency] recommendations? Also important and not that difficult, formal design, im
by westurner 2y ago
Are there SAST or linting tools to check that the code is compliant with the [agency] recommendations?
Also important and not that difficult, formal design, implementation, and formal verification;
"Formal methods only solve half my problems" https://news.ycombinator.com/item?id=31617335 https://news.ycombinator.com/item?id=31617335
"Why Don't People Use Formal Methods?"
https://news.ycombinator.com/item?id=18965964 https://news.ycombinator.com/item?id=18965964
Formal Methods in Python; FizzBee, Nagini, deal-solver:
https://news.ycombinator.com/item?id=39904256#39958582 https://news.ycombinator.com/item?id=39904256#39958582
- bumby 2y agoI’m not aware of any tools for analysis geared to NASA requirements specifically, but static analysis is a requirement for some types of development.
- westurner 2y agoWhy isn't there tooling to support these recommendations; why is there no automated verification? SAST and DAST tools can be run on_push with git post-receive hooks or before commit with pre commit. (GitOps; CI; DevOpsSec with Sec shifted left in the development process is DevSecOps)
- bumby 2y agoI don’t work there so I can’t speak definitely, but much of it probably stems from the sheer diversity of software. For example, ladder logic typically does not have the same tools as structured programming but is heavily used in infrastructure. It is also sometimes restricted to specify a framework, leaving contractors to develop in whatever they want.