Re: security checkup in source control software

Quoting Mads Rasmussen ([email protected]):
> A friend of mine mentioned that a time ago he worked at a company where 
> they used CVS for source control. They implemented routines to scan code 
> when cheking in.
> That way if a developer checked in code that used banned routines such 
> as gets, strcpy etc. he would receive an email as would his manager :-)
> 
> A pitty that this behaviour isn't possible with comercial tools such as 
> PVCS or Microsofts VSS. Not to my knowledge anyway

When you're doing your nightly/daily/hourly build, nothing prevents you
from running these sorts of policy tools on your source as well. On
violations, you can either lock the tree, open a bug in your issue
tracker or whatever the situation calls for.

I personally try to limit the amount of policy checking that takes place
at check-in, as developers understandably get annoyed when they have to
wait several minutes for their commit to complete.

Maybe look at what the mozilla people are doing wrt. building the source
without making the developer wait for the entire process to complete.

-- 
I prefer the dark of the night, after midnight and before four-thirty,
when it's more bare, more hollow.                 http://a.mongers.org