4 ms·
i was trying to map "vulnerability scan all important software repos in the world" to an actual quote on their writing, but "every major operating system and ev
by 0123456789ABCDE 7mo ago
i was trying to map "vulnerability scan all important software repos in the world" to an actual quote on their writing, but "every major operating system and every major web browser, along with a range of other important pieces of software" is not the same.
- tptacek 7mo agoImportant to understand it's not one-and-done; you can't "Mythos" Chrome and then put a checkmark next to it. It's a continuous process.
- SpicyLemonZest 7mo agoCan't you? My understanding is that that's exactly how security scans usually work - you run an analysis, find all the vulnerabilities, and then the continuous process is only there to check against the introduction of new vulnerabilities. Is that not the right mental model?
- tptacek 7mo agoNo, you cannot. (A "security scanner" is a one-and-done proposition because it's deterministic and is going to find what it finds the first time you run and nothing more. But a software security assessment project you run every year on the same target with different teams will turn up different stuff every year. I'm at pains to remind people how totally lame source code security scanners are. People keep saying "static analyzers already do this" and like, nobody in security takes those tools seriously.)
- SpicyLemonZest 7mo agoInteresting. Thanks for the info, I’m going to have to read up on this at some point.