Subject: FreeBSD vs automated code-checking
To: None <netbsd-advocacy@netbsd.org>
From: Stephen Borrill <netbsd@precedence.co.uk>
List: netbsd-advocacy
Date: 06/29/2005 09:19:09
Extract from: 
http://www.theregister.co.uk/2005/06/29/coverity_analyses_freebsd_for_flaws/

On Tuesday, code-analysis software maker Coverity announced that its 
automated bug finding tool had analyzed the community-built operating 
system FreeBSD and flagged 306 potential software flaws, or about one 
issue for every 4,000 lines of code. The tool, which identifies certain 
types of programming errors, has previously been used to find flaws in 
other open-source software, including the Linux kernel and the MySQL 
database.

The low number of flaws found by the system underscores that FreeBSD's 
manual auditing by project members has reduced the vulnerabilities in the 
operating system, said Seth Hallem, CEO of Coverity.

"FreeBSD - as well as OpenBSD and NetBS (sic) - are small communities 
which have made it a priority to build security into the operating system, 
and that has paid dividends," Hallem said.

FreeBSD is the latest open-source project to benefit from being run 
through its paces by code-checking software. Last year, Coverity's tools 
found 950 potential flaws in version 2.6.9 of the Linux kernel, 97 
potential flaws in the MySQL database code, and 26 potential flaws in the 
Berkeley DB code. Moreover, the tool has analyzed the code for OpenBSD, 
with any flaws found submitted back to the project, according to OpenBSD 
members.

-- 
Stephen