English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

In this experience paper, we report on a large-scale empirical study ofStatic Application Security Testing (SAST) in Open-Source Embedded Software(EMBOSS) repositories. We collected a corpus of 258 of the most popular EMBOSSprojects, and then measured their use of SAST tools via program analysis and asurvey (N=25) of their developers. Advanced SAST tools are rarely used -- only3% of projects go beyond trivial compiler analyses. Developers cited theperception of ineffectiveness and false positives as reasons for limitedadoption. Motivated by this deficit, we applied the state-of-the-art (SOTA)CodeQL SAST tool and measured its ease of use and actual effectiveness. Acrossthe 258 projects, CodeQL reported 709 true defects with a false positive rateof 34%. There were 535 (75%) likely security vulnerabilities, including inmajor projects maintained by Microsoft, Amazon, and the Apache Foundation.EMBOSS engineers have confirmed 376 (53%) of these defects, mainly by acceptingour pull requests. Two CVEs were issued. Based on these results, we proposedpull requests to include our workflows as part of EMBOSS Continuous Integration(CI) pipelines, 37 (71% of active repositories) of these are already merged. Insummary, we urge EMBOSS engineers to adopt the current generation of SASTtools, which offer low false positive rates and are effective at findingsecurity-relevant defects.

Finding 709 Defects in 258 Projects: An Experience Report on Applying CodeQL to Open-Source Embedded Software (Experience Paper) -- Extended Report