1

Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer.

ESlint has a rule to indicate, for example, to use {} which would have helped avoid the ‘goto fail;’ bug in Apple products from a few years ago.

What would be the best way to convey this message from a security perspective to a development manager to use a linter (Ex. ESlint) as part of developers "tools"?

  • 1
    Do you have any form of SAST tool in place? If so, you might present findings of this tool that could have been caught during development using linters. – SeeYouInDisneyland Sep 10 '18 at 7:22
  • Grab vulnerable code as an example and show him the linter detecting it. If you can present samples from the OWASP TOP 10 as these rules should be in most linters – McMatty Sep 30 '18 at 21:10
3

Because you are talking to a manager talk to them in terms that make sense to their world - costs.

Linting stops mistakes being made earlier speeding up the release process as well as reducing costs.

enter image description here

In terms of securing a product some linter's provide rules for detecting common security mistakes that say a junior developer may not be aware of. You can also create specific rules yourself for business logic rules you may want to enforce depending on your stack.

This falls into the shift left mentality of software development - my personal favorite is the SonarLint as I have written security rules in it for Java, XML and C# and once written they are provided to developers with the tool installed in their IDE and enforced without them needing to know about the rule other than they must follow it.

1

You should tell your manager the one of lint purposes is security by definition. For example, in Android development, that's exactly what is stated in the official documentation.

I would show him this and explain that lint is a standard practice for preventing some of security issues from happening.

enter image description here

Source

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.