1

I am trying to understand in the new version of Fortify SCA 17.10, why the scan defaults to excluding third-party libraries? I found this article and it seems any open source library you use, it would be in your best interest to get these issues fixed by poll request. I noticed some of the findings I get from a Fortify scan are typically false positives, is this why now Fortify excludes third-party libraries? Is there a legitimate reason for this?

1

1 Answer 1

1

So, I don't know why they did this, but knowing developers and their attitude towards third party software here's my speculation:

  1. Developers tend not care about the whole system, they want to know about the bugs in the code they wrote.
  2. Scanning third party code takes time. Why take time to discover things that the average developer doesn't care about?

Should developers care about the total product's security? Of course. But the typical developer isn't evaluated on that, (s)he is evaluated on the code they produce.

Not the answer you're looking for? Browse other questions tagged or ask your own question.