http://www.gcn.com/online/vol1_no1/46342-1.html 

By Wilson P. Dizard III
GCN.com
05/23/08 

A two-year study of more than 55 million lines of code showed that 
open-source systems include a variety of errors that closely track those 
found in software written for proprietary systems.

The incidence of those errors in open-source code is declining, 
according to a study that the Homeland Security Department funded. The 
department hired Coverity to analyze more than 55 million lines of code 
in two years as part of the government.s Open Source Code Hardening 
Project.

Coverity used its Scan service to help open-source developers improve 
their products' security by pinpointing and categorizing code flaws. 
Scan uses the company's widely deployed Coverity Prevent static 
source-code analysis system.

The two-year project covered more than 250 popular open-source projects.

Open-source software products are improving in quality and security, 
according to the study. Using the Scan service, researchers detected a 
16 percent reduction in source code errors, based on a measure known as 
static analysis defect density, during the past two years. Project 
researchers cited a report from Gartner that states that by 2012, as 
many as four-fifths of all commercial software will include open-source 
code.

The Scan site sorts open-source projects into rungs based on their 
success in eliminating defects, Coverity said. "Projects at higher rungs 
receive access to additional analysis capabilities and configuration 
options," it said. "Projects are promoted as they resolve the majority 
of defects identified at their current rung."

"The continued improvement of projects that already possess strong code 
quality and security underscores the commitment of open-source 
developers to create software of the highest integrity," said David 
Maxwell, open-source strategist at Coverity.

The company said its initial two-year DHS contract is ending, and 
Coverity will continue to operate the Scan site because of the favorable 
response the project has received from software developers and others in 
the open-source community.

The full Open Source Report 2008 is available here [1].

[1] http://www.gcn.com/newspics/Coverity_OpenSourceReport2008.pdf 


_______________________________________________      
Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com