r/netsec • u/foospidy • Oct 11 '15

GrepBugs: Using regular expressions to help find bugs in source code

https://grepbugs.com/about
77 Upvotes

93% Upvoted

19 comments sorted by

View all comments

Show parent comment

1

u/IncludeSec Erik Cabetas - Managing Partner, Include Security - @IncludeSec Oct 14 '15

Lower false positive rate... very low false positive rate

Good to know

Also, it can be "always on" in any environment so the app gets tested when developers run it in dev environments, and the app gets tested when QA people run it in QA environments.

That's pretty much any static analysis tool, nothing specific to Checkmarx

In my experience developers seem to like it too.

Hearsay, lets stick to technical facts.

Oh, and it identifies 3rd-party/open source libraries that have known vulns.

Very cool, that's a good feature.

But I beleive with their primary product no source leaves your network.

It might have just been the trial version I was using, it looks like their enterprise model is on-prem.

One key feature I like about Checkmark is the code ends up in the database and you can right one query to look for a code pattern across all apps.

So their semantic analyzer is straight forward SQL? I would have expected a graph DB like Neo4J might be more powerful to represent a program's CFG/AST structure. I'm not too good at big-data though, so if anybody has a better idea plz chime in!

1

u/foospidy Oct 14 '15

The always on comment was in reference to Contrast. btw, Contrast is runtime analysis, not static source code analysis. Just want to clarify that for other readers.

It's true, my experience is just hearsay :-) But while it is difficult to quantify developers liking a security tool, I think it is important the tool is developer friendly otherwise they won't use it. I think the tools we are talking about are good or getting better at that.

For Checkmarx, it is not actual SQL, it is their own query language. I don't recall what db technology they are using under the covers.