Welcoming Semmle to GitHub

The linked blog post [0] and the new security marketing page [1] both have a little more detail on what this actually means.<p>Basically, Semmle offers a static analysis tool that operates on your source code as a graph (from what I understand) and points out bugs and security holes in your code. Github is now offering that for free on repos at all tiers.<p>[0] <a href="https:&#x2F;&#x2F;github.blog&#x2F;2019-09-18-securing-software-together&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.blog&#x2F;2019-09-18-securing-software-together&#x2F;</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;features&#x2F;security" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;features&#x2F;security</a>

I hate that these kinds of Orwellian phrases &quot;Welcoming X to the Y Family&quot; have now become idiomatic of corporate English. Ugh, no. There is no &quot;family&quot; involved here, not by any stretch of the word.

Free hint for the GitLab - they can integrate a similar but open source tool - Infer[1]. Essentially it provides the similar features, just lacks a good interface to do so. They also have a query language, called AL[2]. It is way less polished than Semmle, but opensource and with a good potential.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;facebook&#x2F;infer" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;facebook&#x2F;infer</a><p>[2] <a href="https:&#x2F;&#x2F;fbinfer.com&#x2F;docs&#x2F;linters.html" rel="nofollow">https:&#x2F;&#x2F;fbinfer.com&#x2F;docs&#x2F;linters.html</a>

Interesting to see the differences between Github and Gitlab&#x27;s strategy in this arena.<p>Github appears to be going the aqui-hire route with Semmle, dependabot, pullpanda etc, where as I don&#x27;t think Gitlab&#x27;s made an acquisition for a year or two.

Semmle&#x27;s post: <a href="https:&#x2F;&#x2F;blog.semmle.com&#x2F;secure-software-github-semmle&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.semmle.com&#x2F;secure-software-github-semmle&#x2F;</a>.

Github has been really working on their source code analysis toolkit recently &amp; this acquisition makes perfect sense as part of that strategy. Congratulations to Oege &amp; the team.

First project I look up on lgtm.com is rust.. Second alert I find is this:<p><a href="https:&#x2F;&#x2F;lgtm.com&#x2F;projects&#x2F;g&#x2F;rust-lang&#x2F;rust&#x2F;snapshot&#x2F;f5aa590b8ca98e925e5b1b975d7aef07e0c7a028&#x2F;files&#x2F;src&#x2F;ci&#x2F;docker&#x2F;scripts&#x2F;android-sdk-manager.py#x2e8f6c458bb40362:1" rel="nofollow">https:&#x2F;&#x2F;lgtm.com&#x2F;projects&#x2F;g&#x2F;rust-lang&#x2F;rust&#x2F;snapshot&#x2F;f5aa590b...</a><p>exist_ok is available from python 3.2, so this isn&#x27;t a good impression.<p><a href="https:&#x2F;&#x2F;docs.python.org&#x2F;3.7&#x2F;library&#x2F;os.html#os.makedirs" rel="nofollow">https:&#x2F;&#x2F;docs.python.org&#x2F;3.7&#x2F;library&#x2F;os.html#os.makedirs</a>

Huge congrats to Oege and the team at Semmle - couldn&#x27;t be happier for a hugely passionate and smart individual (and a previous professor of mine!)<p>Am sure this will bring some amazing advances to Github and thus a huge % of the developer community.

&quot;Human progress depends on the open source community.&quot;<p>What a way to begin an article.

I&#x27;ve just tested their lgtm.com on our codebase:<p>1) identified str.replace(&#x27;[ABC]+&#x27;, &#x27;&#x27;) correctly as a bug (looks like a regex but is string literal)<p>2) identified various unnecessary code that TypeScript overlooked<p>3) identified double-unescaping of html (this one would have probably gone unnoticed for years)<p>And a bunch of other stuff. No actual vulnerability in our case, but still very useful. I&#x27;m enabling their checks on every future PR.<p>This was TypeScript but they support the rest of our stack too (Python, Java). I wonder if this includes Kotlin - will try.

&gt; Human progress depends on the open source community.<p>(Non native speaker here). Am I misunderstanding something, or is the author explaining that humanity can not progress without the open source community?

I&#x27;ve used semmle&#x27;s tools at Google, they seemed pretty powerful.

I spent way too long thinking that Semmie was just a badass programmer

Would be cool if the tools would be made open source in order for everyone to get more security.

So this is the excuse they&#x27;re using to build infrastructure to scan through everyone&#x27;s code to find whatever they want.