No, you cannot trust third party code without reading it first

Re:No, you cannot trust third party code without reading it ... by rufflez on Thursday August 11, 2022 @08:36PM (#32433538)

Is your own code free of security vulnerabilities?

Will you be able to identify and avoid issues with 3rd party libraries by reading their code, and the code of all the other libraries that they depend on?

Do you know what all vulnerabilities exist in cyberspace?

I mean that a static code analysis tool can take you much further than reading 3rd party code manually... and that is still going to fall short, but that is as good as it gets

[ Parent | on HN ]

Re:No, you cannot trust third party code without reading it ... by halostatue on Thursday August 11, 2022 @10:44PM (#32434238)

Do you read the source code of the static code analysis tool to make sure that it’s not hiding some obvious backdoors?

[ Parent | on HN ]

Re:No, you cannot trust third party code without reading it ... by rufflez on Friday August 12, 2022 @12:59AM (#32434868)

I look at the outcome, and can certainly say that the tools I use find issues than I didn't know existed

[ Parent | on HN ]