August 2016 – Code Curmudgeon

Originally published on Code Curmudgeon in August 2016. Substantially rewritten September 2026. What I got wrong the first time is at the end. Everybody...

Definitioner

SBOM

SBOM stands for Software Bill of Materials. It is a manifest of all the code in a system, device, or application including particular code and libraries from open source software, third parties, etc. It allows users to know what's actually in an application, and thereby do security update, recalls, etc. in the same manner that is currently done for hardware like for medical and automotive. In the USA there is an effort to better define common standards and methods around SBOM being headed by the NTIA. See https://www.ntia.gov/sbom

SCA

SCA or software composition analysis means that you analyze what "other" software is included in your application or system. For example do you use a commercially available library, an open source library, or build OSS straight into your application. If so, then you should be scanning these from a security perspective for known vulnerabilities so you can patch and keep them up-to-date to avoid zero-day security issues.

software composition analysis (SCA)

vulnerability

This is a tricky word, especially in application security or cybersecurity. The simple definition in a software context is that the code has some problem that could be exploited by someone at some point. Some think of it as a piece of code with a proven exploit, IE a static analysis violation with a stack trace and values used. This is a very narrow definition that probably doesn't help improve the state of the art. I prefer the idea that it's code that is exploitable based on the body of knowledge (as encapsulated in software coding standards).

CAN (Controller Area Network)

Controller Area Network aka CAN aka CAN Bus is a wiring standard for vehicles that enables communication between various components and devices without having a host computer. For example doors, brakes, transmission.

DMCA

A United States digital rights bill signed in 1998 by Bill Clinton. The aim of DMCA is to protect the rights of both copyright owners and consumers. The act is controversial and some feel that it limits innovation and consumer choice to the benefit of existing content interests such as the RIAA and movie industry.

PR (NIST)

National Institute of Standards and Technology

PR (SATE)

Static Analysis Tool Exposition is an effort by NIST to help people understand what static analysis tools are capable of, and what their limitations are.

PR (Issue Tracking System)

Software that manages a list of problems or issues that an organization faces, such as bugs, tech support calls, etc.

AI (HTML5)

HTML5 is the most recent version of the HTML standard. It is a language used to create web pages. Currently it is a draft standard, but it supported by all major browsers. HTML4 is the current actual standard.

AI (AJAX)

Asynchronous JavaScript and XML. It's a set of web technologies that help create interactive web applications.

AI (Flash)

Web-based multimedia platform. Used for putting animation, interactivity, and video on web pages.

AI (BASIC)

Beginners All Purpose Symbolic Instruction Code. A programming language designed specifically for beginners.

AI (artificial intelligence)

An attempt to make computers work/talk/act like people. Traditional definitions included a simple test that if a person dealing with a computer, for example via a keyboard and monitor, could not tell that there was a computer on the other end, then it was artificial intelligence. Modern definitions are more strict.

static analysis

Any form of software analysis that can be done on the code without actually executing the code. Encompasses techniques like pattern-based analysis, metrics, code review, etc.

Monthly Archives: August 2016

Keynote at EuroAsiaSPI2 2016 Conference

Understanding Open Source Licenses