December 2022 Summaries

SonarQube 9.8 is now available with improved PR analysis and new rules for various programming languages including JavaScript, TypeScript, Kotlin, Java, C++, and Python. The release also includes features like SARIF report importing, SCIM user provisioning and de-provisioning, better project onboarding, and improved server operability. This is the last release before SonarQube 9.9 LTS, scheduled for February, with additional highlights such as Fast PRs for Kotlin, JavaScript rules to master the AWS CDK, C++ 20 concepts, and more.

In the software landscape, the concept of clean code has gained importance as organizations rely heavily on their source code for long-term success. A healthy, happy codebase is crucial for a company's survival, and its DNA dictates its overall health. With cloud-native technologies such as serverless, IaC, and Kubernetes, maintaining clean code is essential to stay ahead of the competition. The developer's responsibility extends beyond just eliminating bugs, but also includes taking ownership of maintainability, security, and overall code complexity. This approach demands a fundamentally different mindset from traditional software development, where developers should be proactive in ensuring their code meets high standards of quality. By adopting clean coding practices, organizations can reap benefits such as improved efficiency, good vibes among developers, and increased user satisfaction, ultimately contributing to the success of their customers. The concept of clean code has become a necessity for sustainable app development, and its adoption is crucial for the global development community to build reliable, secure, and maintainable software that delights users and builds customer goodwill.

The Vulnerability Research team participated in Pwn2Own Toronto 2022, a competition organized by the Zero Day Initiative, part of Trend Micro. The goal is to find and exploit vulnerabilities on devices such as routers, phones, and printers. This year's event saw 66 entries from 26 teams, with most targeting IoT devices like routers and NAS. The team discovered four valid entries, including two WAN-side vulnerabilities on the Synology RT6600ax and NETGEAR RAX30 routers, which were later patched by vendors. Despite not being able to exploit their LAN-side vulnerabilities due to firmware updates, they still managed to demonstrate a valid entry on the Synology device. The event highlights the security risks of end-user routers and IoT devices, emphasizing the importance of secure development practices throughout the software development lifecycle.

A Clean Code solution like SonarCloud empowers developers by delivering comprehensive code feedback in their environment, providing instant feedback as they write code, and offering full visibility into the quality of a project. It helps teams enforce Clean Code practices through the "Clean as You Code" methodology, which encourages incremental improvement of code quality over time, rather than focusing on technical debt removal after the fact. This approach allows developers to own the quality of their code, ensuring that no critical issues are added to the code base and promoting a culture of clean coding within the team. Additionally, SonarCloud provides customizable Quality Gates and Quality Profiles to align with the team's coding standards, enabling teams to define and enforce their own standards for delivering high-quality code.

Clean code is essential for software development as it makes it easier to introduce changes and enhancements without wasting time on issues. Clean code ensures that software continues to be an asset, not a liability, and is crucial for business success. Quality profiles are used to define rules for code analysis, with Sonar providing a built-in profile called the Sonar way profile that can be customized as needed. Customizing quality profiles requires regular review to ensure new rules are included and deprecated ones are removed. Quality gates enforce a quality policy by measuring conditions such as blocker issues and code coverage, and notifications are sent when these conditions fail. Enterprise reporting provides insights into project health and releasability through project reports, portfolios, and scheduled reports in PDF format.

We started using SonarQube as part of our development workflow after realizing that it would be much more than a security gateway in our process, and we quickly discovered its potential to improve code quality, prioritize efforts together with the project manager, create onboarding tickets for new joiners, and align best practices across teams. However, we initially made mistakes by not understanding how SonarQube is meant to be used, installing it without sufficient knowledge, and only seeing it as a tool that provides statistics about our code rather than embracing the Clean Code approach. We learned from these mistakes and established strong technical foundations, created alignment on our Clean Code strategy with project stakeholders, defined and enforced a quality profile with a set of rules that made sense for us, and empowered developers to own the quality of their code.