October 2023 Summaries

The concept of "shift left" in software development refers to identifying and fixing defects as early as possible in the development process, shifting quality assurance activities earlier in the process. This approach has been beneficial for decades, with a recent expansion of focus to include tools that help identify issues on the right-hand side of the deployment lifecycle. The tools mentioned, such as SonarLint, SonarQube, and SonarCloud, can detect bugs, code smells, and vulnerabilities before they get into production, reducing costs, improving software quality, increasing speed of development, and reducing risks associated with software failures. The shift to "shift right" involves testing the code of infrastructure, such as Kubernetes templates and Docker configuration, to detect bugs and vulnerabilities in the resulting software, ensuring security best practices and regulatory requirements are met. This can be achieved through tools like SonarLint and SonarQube, which identify issues such as secrets detection and platform configuration problems that wouldn't have a significant impact during local development.

We found that about half of the open source maintainers are currently using AI-based coding tools, with a significant age-related difference in usage. Those who use these tools report using them for code completion and suggestions, as well as for documentation and testing. Many respondents also express concerns about the accuracy and reliability of these tools. The survey highlighted several areas where AI could be used to improve open source software development, including documentation, issue triage, code quality and review, dependency management and security, and automating tasks such as changelog summaries and release notes generation.

Clean Code` is a classification system that focuses exclusively on code, aims to classify nonconformities based on actual code properties rather than potential consequences, and encompasses four categories: consistent, intentional, adaptable, and responsible. The `Consistent` category emphasizes consistency in style, idiomatic syntax, and readability, while the `Intentional` category highlights clear and unambiguous instructions, logical soundness, thoroughness, and efficiency. The `Adaptable` category focuses on minimizing duplication, focusing units to a specific scope, and using encapsulation techniques. Finally, the `Responsible` category addresses ethical considerations such as avoiding hard-coding secrets, respecting laws and licensing regulations, and promoting inclusivity. This classification system is intended to provide a solid foundation for Clean Code, with the goal of gradually rolling it out in Sonar products and classifying issues based on actual code properties rather than potential consequences.

Hexacon is a premier IT security conference that has gained recognition as a prominent platform for cybersecurity professionals and enthusiasts. The event serves as a hub for discussing highly technical content in the field of offensive IT security, providing a unique opportunity for participants to learn about the latest vulnerabilities and exploitation techniques, share knowledge, and network with like-minded individuals. The conference took place in the historic Palais Brongniart in Paris, France, offering an impressive atmosphere for a highly professional event. Hexacon featured a variety of talks on different topics, including vulnerability research, exploitation techniques, and security testing, presented by renowned experts such as Cheng-Da Tsai, Piotr Bazydło, Simon Scannell, and Stefan Schiller. The conference also included on-site training sessions and hands-on challenges for participants who wanted to engage in practical learning experiences. Overall, Hexacon 2023 exceeded expectations, providing an amazing experience for attendees, and setting the stage for a successful conference that will be remembered by cybersecurity professionals and enthusiasts alike.

CasaOS, a personal cloud solution with over 17,000 GitHub stars, has been found to have two critical code vulnerabilities, CVE-2023-37265 and CVE-2023-37266. These vulnerabilities allow attackers to bypass authentication requirements and gain full access to the CasaOS dashboard, as well as execute arbitrary commands on the system. The first vulnerability is caused by a common design bug in reverse proxies, which can be exploited to bypass IP address validation. The second vulnerability involves a weak secret used in session JWTs, allowing attackers to craft arbitrary tokens and bypass authentication. These vulnerabilities highlight the importance of education and security best practices when designing software features, particularly those that support third-party applications, such as Docker containers. CasaOS maintainers have addressed these vulnerabilities through patches, but users are still encouraged to update their instances to the latest available release.

Analyzing benchmarks with SAST products can help assess their capabilities, but results may vary due to intentionally faked vulnerabilities or limitations in detecting business logic flaws. Two categories of test cases that are often excluded from ground truth datasets include fake vulnerabilities and purely business logic vulnerabilities. Fake vulnerabilities, such as those found in the WebGoat platform, are intentionally designed to be undetectable by SAST tools, while purely business logic vulnerabilities rely on context and human understanding to identify potential security issues. As a result, SAST tools excel at detecting code-level issues but may struggle with detecting issues that require contextual understanding, such as authentication or access-control flaws.

Sonar has a strong affinity for Java, with many team members passionate about improving the language. The company values learning-friendly and fun coding experiences, as well as tools that support developers in creating high-quality code. Key takeaways from the interviews include the importance of clean code, performance, security, and community involvement. The Java ecosystem is mature and stable, offering a wide range of open-source libraries, frameworks, and tools for developers to leverage. Ahead-of-time compilation, new features like Records and Pattern matching, and improvements in tooling have also generated excitement among the team members. Clean Code is seen as essential for writing code that can be proud of over time, easy to read, understand, and maintain. The Java community provides a wealth of opportunities for growth, learning, and collaboration, making it an attractive space for developers to contribute and share knowledge.

Clean Code` refers to code that is consistent, intentional, adaptable, and responsible. It's essential for security, productivity, and velocity in software development. Without clean code, developers are left with a liability instead of an asset, leading to increased risk, fragility, and technical debt. Sonar's `Clean as You Code` approach focuses on fixing the leak by making sure new code is clean, remediating past issues, and optimizing DevOps workflows. This approach differentiates Sonar from competitors who focus on security reviews after development is complete. By serving developers first, Sonar benefits both developers and security teams, resulting in faster delivery, reduced risk, and increased productivity.

The author was recently interviewed on the C++ podcast about static analysis, which he has been working on for over a year. He discussed how his experience in finance led him to develop an interest in finding ways to automate productivity gains through code analysis. However, he noted that C++ tooling is more complex than other languages due to its compilation and parsing complexities. The author highlighted the challenges of static analysis, including path explosion, which makes it difficult to track exponentially increasing possible states. He emphasized the importance of understanding why issues exist and providing knowledge to avoid writing problematic code in the first place. The author also discussed how Sonar tools fit into this landscape, offering a range of solutions including SonarLint, SonarQube, and SonarCloud, which provide real-time feedback and automated analysis for C++ projects. Recently released Automatic Analysis for C++, allows users to set up C++ analysis with minimal configuration, making it more accessible to developers.