BestHub
Sign in
Tagged articles
65 articles
Page 1 of 1
Black & White Path
Black & White Path
May 3, 2026 · Information Security

Claude Security Public Beta: How AI‑Driven Scanning Moves Code Security into Production

Claude Security’s public beta demonstrates how Anthropic’s AI‑driven scanner moves vulnerability detection from post‑deployment patching to pre‑commit prevention, offering full‑repo analysis, multi‑stage verification, IDE integration, lower false positives, and sparking industry debate over dual‑use risks and regulatory impact.

AI code scanningAnthropicClaude Security
0 likes · 10 min read
Claude Security Public Beta: How AI‑Driven Scanning Moves Code Security into Production
AntTech
AntTech
Apr 7, 2026 · Information Security

How YASA Enables Scalable Multi‑Language Taint Analysis with a Unified AST

The article introduces YASA, a unified multi‑language static taint analysis framework built on a novel Unified Abstract Syntax Tree (UAST), explains its design, core components, open‑source releases, and benchmark results that demonstrate superior coverage, precision, and performance over existing single‑ and multi‑language tools.

Multi-languageSoftware SecurityUAST
0 likes · 9 min read
How YASA Enables Scalable Multi‑Language Taint Analysis with a Unified AST
Top Architecture Tech Stack
Top Architecture Tech Stack
Apr 1, 2026 · Artificial Intelligence

What the Claude Code Leak Reveals About the Future of AI Programming Agents

The massive Claude Code source leak—over 1,900 TypeScript files, 512,000 lines of code, and a 59.8 MB source map—exposes the inner architecture of Anthropic's AI programming agent, showing a complex system of modular tools, multi‑agent orchestration, persistent memory, and security controls that signal a shift from simple code completion to full‑stack AI development assistants.

AI programmingClaude CodeSoftware Security
0 likes · 20 min read
What the Claude Code Leak Reveals About the Future of AI Programming Agents
21CTO
21CTO
Mar 13, 2026 · Fundamentals

Tony Hoare: The Genius Behind Quicksort, Null References, and a Billion‑Dollar Error

Tony Hoare, Turing Award laureate and creator of Quicksort, introduced the null reference in 1965—a design later dubbed the “billion‑dollar mistake”—and spent his career advancing programming language theory, concurrency models, and formal verification, while his public apology in 2009 spurred a wave of safer language designs.

QuickSortSoftware SecurityTony Hoare
0 likes · 12 min read
Tony Hoare: The Genius Behind Quicksort, Null References, and a Billion‑Dollar Error
DevOps in Software Development
DevOps in Software Development
Mar 11, 2026 · Industry Insights

Can Continuous Authorization (cATO) Revolutionize Secure Software Delivery in High‑Security Sectors?

This article examines the US DoD's Continuous Authorization (cATO) framework, explains its core capabilities and implementation engine, and explores how its principles can be adapted to China’s tightly regulated military and critical‑infrastructure environments despite air‑gapped constraints.

Compliance AutomationDevSecOpsSoftware Security
0 likes · 11 min read
Can Continuous Authorization (cATO) Revolutionize Secure Software Delivery in High‑Security Sectors?
21CTO
21CTO
Jan 16, 2026 · Information Security

Do AI Coding Agents Introduce Critical Security Flaws? Insights from a Vibe Study

A Tenzai research team evaluated five popular AI coding agents on three Vibe‑generated applications, uncovering comparable bug counts but severe vulnerabilities in Claude, Devin, and Codex outputs, highlighting systemic authorization flaws and the risks of low‑code AI development.

AI SafetyAI coding agentsCode Generation
0 likes · 5 min read
Do AI Coding Agents Introduce Critical Security Flaws? Insights from a Vibe Study
Tencent Technical Engineering
Tencent Technical Engineering
Dec 19, 2025 · Artificial Intelligence

How Safe Is AI-Generated Code? Real‑World Risks and Mitigation Strategies

This study investigates the security performance of AI‑generated code in real‑world software projects, revealing high vulnerability rates, language‑specific adoption patterns, and evolving roles in the vulnerability lifecycle, and proposes a multi‑dimensional framework for risk mitigation and safe AI‑assisted development.

AICode GenerationEmpirical Study
0 likes · 16 min read
How Safe Is AI-Generated Code? Real‑World Risks and Mitigation Strategies
Continuous Delivery 2.0
Continuous Delivery 2.0
Nov 20, 2025 · Information Security

Why SBOM Is Critical for Modern Software Security and How to Choose Between SPDX and CycloneDX

The article explains what a Software Bill of Materials (SBOM) is, why it has become a strategic security requirement, compares the leading SPDX and CycloneDX standards, examines China's emerging DSDX format, and offers practical guidance on selecting the right SBOM format and tools for various compliance and risk‑management scenarios.

CycloneDXSBOMSPDX
0 likes · 13 min read
Why SBOM Is Critical for Modern Software Security and How to Choose Between SPDX and CycloneDX
Architect's Guide
Architect's Guide
Sep 30, 2025 · Information Security

Are Software Backdoors Legal? Real Cases, Legal Views, and Hidden Threats

This article examines real‑world anecdotes of hidden backdoors in software, explores how Chinese law treats such vulnerabilities, and outlines the hierarchy of backdoor techniques from simple code tricks to compiler‑level implants, highlighting the security risks they pose.

Software Securitybackdoorcompiler
0 likes · 6 min read
Are Software Backdoors Legal? Real Cases, Legal Views, and Hidden Threats
21CTO
21CTO
Sep 24, 2025 · Information Security

How GitHub’s New npm Security Measures Aim to Stop Supply‑Chain Worms

GitHub is tightening npm security by removing infected packages, enforcing two‑factor authentication for publishing, shortening token lifespans, and expanding trusted publishing to curb the Shai‑Hulud worm and protect the open‑source supply chain.

GitHubSoftware SecurityTwo-Factor Authentication
0 likes · 3 min read
How GitHub’s New npm Security Measures Aim to Stop Supply‑Chain Worms
FunTester
FunTester
Jul 21, 2025 · Information Security

Unlock Hidden Bugs: How Fuzz Testing Strengthens Java Security and Stability

Fuzz testing injects massive amounts of random or semi‑random inputs into applications to expose crashes, logic errors, and security flaws, and the article explains its principles, the types of defects it uncovers, real‑world practices at Google Chrome, and step‑by‑step Java integration using CI Fuzz and JUnit.

CI FuzzDynamic analysisJUnit
0 likes · 7 min read
Unlock Hidden Bugs: How Fuzz Testing Strengthens Java Security and Stability
Tencent Technical Engineering
Tencent Technical Engineering
Jul 16, 2025 · Artificial Intelligence

Introducing A.S.E: The First Project‑Level AI Code Generation Security Evaluation Framework

The A.S.E (AI Code Generation Security Evaluation) framework provides a comprehensive, project‑level benchmark for assessing the safety, quality, and stability of AI‑generated code across multiple languages and vulnerability types, helping developers and researchers evaluate and improve large language model coding assistants.

AI code generationSoftware Securityopen source benchmark
0 likes · 7 min read
Introducing A.S.E: The First Project‑Level AI Code Generation Security Evaluation Framework
AntTech
AntTech
May 16, 2025 · Information Security

How CDFuzz’s Targeted Dictionary Boosts Grey‑Box Fuzzing Coverage by 16%

The award‑winning CDFuzz technique introduces a lightweight, targeted dictionary that eliminates extra instrumentation, achieves up to 16.1% higher coverage, discovers dozens of real bugs, and demonstrates that simple optimizations can outperform complex grey‑box fuzzing strategies across diverse file formats.

CDFuzzSoftware Securitycoverage improvement
0 likes · 6 min read
How CDFuzz’s Targeted Dictionary Boosts Grey‑Box Fuzzing Coverage by 16%
Tencent Technical Engineering
Tencent Technical Engineering
Mar 19, 2025 · Information Security

AI Programming Security Risks and Countermeasures

As AI tools soon generate the majority of software, they dramatically amplify hidden security risks—such as hard‑coded secrets, XXE, directory traversal, and privilege escalation—requiring zero‑trust scanning, secret interception, command filtering, privilege‑fuse safeguards, and AI‑native semantic analysis to protect the modern code supply chain.

AI programmingAI securitySoftware Security
0 likes · 9 min read
AI Programming Security Risks and Countermeasures
OPPO Amber Lab
OPPO Amber Lab
Dec 20, 2024 · Information Security

How Kernel Fuzzing Uncovers Hidden OS Vulnerabilities: Techniques & Tools

Fuzz testing, originating in the 1990s, employs random and malformed inputs to stress software, and this article explores its application to operating system kernels, detailing design of input generation, mutation strategies, execution monitoring, and iteration techniques across tools like AFL, Syzkaller, kAFL, and UnicornFuzz.

AFLOperating SystemsSoftware Security
0 likes · 12 min read
How Kernel Fuzzing Uncovers Hidden OS Vulnerabilities: Techniques & Tools
21CTO
21CTO
Nov 1, 2024 · Information Security

Why the US Government Is Cracking Down on Unsafe Coding Practices

The U.S. CISA and FBI have issued a stern warning to software vendors, demanding the elimination of unsafe coding practices—especially the use of memory‑unsafe languages like C/C++—by January 1 2026, or risk being labeled negligent and jeopardizing national security.

CISAMemory SafetySoftware Security
0 likes · 8 min read
Why the US Government Is Cracking Down on Unsafe Coding Practices
IT Services Circle
IT Services Circle
Sep 23, 2024 · Fundamentals

Safe C++: A Revolutionary Extension Proposal for Memory Safety in C++

An overview of the Safe C++ extension proposal, developed by the C++ Alliance and Sean Baxter, which aims to add memory‑safety features to C++, includes example code, discusses its significance for software security, and references industry and governmental interest in safer programming languages.

C++ISO StandardMemory Safety
0 likes · 5 min read
Safe C++: A Revolutionary Extension Proposal for Memory Safety in C++
Code Mala Tang
Code Mala Tang
Jun 14, 2024 · Information Security

Why and How to Sign Your Electron App: Boost Security with Code Signing

Code signing verifies software authenticity and integrity, preventing tampering and security warnings, and this guide explains what code signing is, its types, applicable file formats, certificate options, and step‑by‑step instructions—including Electron‑builder configuration and sample scripts—to help developers secure their desktop applications.

Code SigningEV certificateElectron
0 likes · 9 min read
Why and How to Sign Your Electron App: Boost Security with Code Signing
ITPUB
ITPUB
May 20, 2024 · Information Security

How a Hidden Backdoor in XZ Compression Threatens Global Open‑Source Infrastructure

A recent backdoor implanted in the widely used open‑source compression tool XZ exposes the fragile reliance on volunteer‑maintained software infrastructure, highlighting the massive economic value of open‑source, the sophisticated attack methods employed, and the urgent need for better security and maintenance practices.

Software Securitybackdoorinformation security
0 likes · 6 min read
How a Hidden Backdoor in XZ Compression Threatens Global Open‑Source Infrastructure
php Courses
php Courses
May 6, 2024 · Backend Development

Static Code Analysis with PHPStan: Benefits, Installation, and Integration

This article explains static code analysis, introduces PHPStan as a leading PHP static analysis engine, outlines its advantages, provides step‑by‑step installation and configuration instructions, describes level upgrades, and shows how to integrate it into development workflows to improve code quality and security.

BackendPHPStanSoftware Security
0 likes · 8 min read
Static Code Analysis with PHPStan: Benefits, Installation, and Integration
DevOps Engineer
DevOps Engineer
Apr 29, 2024 · Information Security

Understanding Code Signing: Importance, Process, and Tool Comparison

This article explains what code signing is, why it is essential for software integrity and trust, outlines the signing process, compares traditional code signing certificates with the GaraSign cloud service, and offers guidance on choosing the right solution based on cost, scalability, and compliance needs.

Code SigningSoftware Securitydigital certificates
0 likes · 7 min read
Understanding Code Signing: Importance, Process, and Tool Comparison
21CTO
21CTO
Apr 17, 2024 · Artificial Intelligence

Why Gentoo Linux Is Banning AI‑Generated Code and What It Means for Developers

Gentoo Linux has banned AI‑generated code contributions, citing copyright risks, quality control issues, ethical concerns over AI power consumption, and the influence of large corporations, while outlining the policy’s adoption process and future possibilities for controlled AI use.

AI-generated codeCopyrightGentoo
0 likes · 6 min read
Why Gentoo Linux Is Banning AI‑Generated Code and What It Means for Developers
21CTO
21CTO
Mar 23, 2024 · Information Security

Why Bjarne Stroustrup Defends C++ Against the US Government’s Memory‑Safety Push

Amid a US government report urging developers to abandon C and C++ for memory‑safe languages, C++ creator Bjarne Stroustrup argues that modern C++ already incorporates strong safety guarantees, cites ongoing standards work, and warns that abandoning the language overlooks its evolving security features.

Bjarne StroustrupC++Memory Safety
0 likes · 6 min read
Why Bjarne Stroustrup Defends C++ Against the US Government’s Memory‑Safety Push
21CTO
21CTO
Feb 29, 2024 · Information Security

Why the White House Wants Developers to Abandon C and C++ for Memory‑Safe Languages

The White House’s ONCD report urges developers to replace C and C++ with memory‑safe languages like Rust, Go, and Java, citing alarming vulnerability statistics and a strategic shift that moves software‑security responsibility from individuals to large organizations and the federal government.

C++Government policyMemory Safety
0 likes · 8 min read
Why the White House Wants Developers to Abandon C and C++ for Memory‑Safe Languages
OPPO Kernel Craftsman
OPPO Kernel Craftsman
Dec 29, 2023 · Information Security

OPPO Releases White Paper on Mobile Application Trustworthy Technology at CAICT ICT+ Deep Observation Conference

At the CAICT ICT+ Deep Observation Conference, OPPO unveiled a white paper on mobile application trustworthy technology, analyzing lifecycle security risks, policy and patent developments, and the role of large‑model AI in intelligent terminals, while urging standardized security practices and accelerated AI‑driven vulnerability detection tools.

CAICTIntelligent TerminalsMobile Application Security
0 likes · 4 min read
OPPO Releases White Paper on Mobile Application Trustworthy Technology at CAICT ICT+ Deep Observation Conference
OPPO Amber Lab
OPPO Amber Lab
Dec 29, 2023 · Information Security

Large Models Transform Mobile App Security – Key Takeaways from OPPO’s White Paper

The 2024 China Academy of ICT deep‑observation summit in Shanghai unveiled OPPO’s new white paper on trustworthy mobile application technology, highlighting how large language models enhance smart terminal security, outlining industry trends, and outlining future directions for secure, intelligent mobile ecosystems.

OPPOSoftware Securitylarge language models
0 likes · 6 min read
Large Models Transform Mobile App Security – Key Takeaways from OPPO’s White Paper
DevOps
DevOps
Aug 9, 2023 · Information Security

From DevOps to DevSecOps: Integrating Security into the Software Development Lifecycle and Using Microsoft Threat Modeling Tool

This article explains how DevSecOps extends DevOps by embedding security throughout the software development lifecycle, discusses common threats such as SQL injection and broken access control, outlines the Security Development Lifecycle, and provides a step‑by‑step guide to using Microsoft’s Threat Modeling Tool for risk mitigation.

DevSecOpsMicrosoft ToolSecurity Development Lifecycle
0 likes · 20 min read
From DevOps to DevSecOps: Integrating Security into the Software Development Lifecycle and Using Microsoft Threat Modeling Tool
Continuous Delivery 2.0
Continuous Delivery 2.0
May 5, 2023 · Information Security

An Introduction to Fuzz Testing and the AFL Workflow

This article explains the fundamentals of fuzz testing, describes its core concepts and step‑by‑step process, compares mutation‑based and generation‑based test case generation algorithms, and details the popular open‑source AFL tool, its workflow, mutation strategies, and practical advantages.

AFLSoftware SecurityTest Case Generation
0 likes · 8 min read
An Introduction to Fuzz Testing and the AFL Workflow
Python Programming Learning Circle
Python Programming Learning Circle
Mar 31, 2023 · Information Security

Backdoors in Software: Real-World Cases, Legal Perspectives, and Security Implications

The article recounts real-world examples of hidden backdoors in software—from an Android ROM project and Ken Thompson’s compiler-level exploit—to discuss their legal ambiguity in China, highlight the challenges of detection, and conclude with a call for developers to share their own experiences, alongside a promotional Python course.

AndroidSoftware Securitybackdoor
0 likes · 6 min read
Backdoors in Software: Real-World Cases, Legal Perspectives, and Security Implications
Efficient Ops
Efficient Ops
Mar 24, 2023 · Information Security

How ICBC Built an Enterprise‑Scale Code Scanning Center to Boost Software Security

This article describes how Industrial and Commercial Bank of China tackled rising software vulnerabilities by establishing a unified code‑scanning center, integrating static, supply‑chain, and dynamic analysis tools, standardizing rules, and delivering one‑stop services that have scanned over 3.1 billion lines of code across the bank.

Code ScanningSoftware Securitybanking IT
0 likes · 7 min read
How ICBC Built an Enterprise‑Scale Code Scanning Center to Boost Software Security
21CTO
21CTO
Feb 7, 2023 · Information Security

Why Bjarne Stroustrup Says the NSA’s Call to Ditch C/C++ Misses the Mark

At the end of 2022 the NSA warned that C and C++ are unsafe and urged a shift to languages like Rust or Go, but Bjarne Stroustrup counters that modern C++ offers robust static analysis, type and resource safety, and that the agency’s view overlooks these advances.

CMemory SafetySoftware Security
0 likes · 6 min read
Why Bjarne Stroustrup Says the NSA’s Call to Ditch C/C++ Misses the Mark
Sohu Tech Products
Sohu Tech Products
Oct 19, 2022 · Information Security

Secure Software Development: SDL, Tool Configurations, and Safe Coding Practices

This article outlines essential practices for secure software development, covering Microsoft's Security Development Lifecycle, Visual Studio security features, and comprehensive secure coding guidelines—including safe APIs, SafeInt library usage, trust boundaries, type casting, and file operation safeguards—to reduce vulnerabilities such as buffer overflows and memory errors.

CSDLSecure Coding
0 likes · 10 min read
Secure Software Development: SDL, Tool Configurations, and Safe Coding Practices
21CTO
21CTO
Sep 22, 2022 · Fundamentals

Why Is Microsoft’s Azure CTO Calling for the End of C/C++? The Rise of Rust

Microsoft Azure CTO Mark Russinovich argues that C and C++ should be retired for new projects in favor of Rust, highlighting memory‑safety benefits, industry adoption challenges, and responses from language creators, while examining the broader impact on system software development.

C++Memory SafetyRust
0 likes · 7 min read
Why Is Microsoft’s Azure CTO Calling for the End of C/C++? The Rise of Rust
21CTO
21CTO
Aug 24, 2022 · Fundamentals

Why Rust Is Shaping the Future of Safe System Programming

An interview with Rust creator Graydon Hoare explores the language's origins, its emphasis on speed, memory safety and concurrency, its adoption by major tech firms, and his perspective on the current state and future challenges of system programming security.

Memory SafetyRustSoftware Security
0 likes · 6 min read
Why Rust Is Shaping the Future of Safe System Programming
Laravel Tech Community
Laravel Tech Community
Jul 24, 2022 · Information Security

Backdoors in Software Delivery: Real‑World Cases, Legal Perspectives, and Compiler‑Level Vulnerabilities

The article recounts three Zhihu answers that illustrate how hidden backdoors are used in software projects to secure payments, discusses the ambiguous legal status of such practices in China, and explores historic and advanced backdoor techniques ranging from driver‑level tricks to compiler‑injected vulnerabilities.

Legal AnalysisSoftware Securitybackdoor
0 likes · 6 min read
Backdoors in Software Delivery: Real‑World Cases, Legal Perspectives, and Compiler‑Level Vulnerabilities
DeWu Technology
DeWu Technology
Jul 15, 2022 · Information Security

Software Composition Analysis (SCA): Overview, Challenges, and Implementation

Software Composition Analysis (SCA) identifies and tracks open‑source components across languages, matches them to vulnerability databases, and integrates risk detection into CI pipelines, helping organizations mitigate widespread flaws like Log4j2 while addressing challenges of diverse package formats, binary analysis, and accurate vulnerability correlation.

Dependency AnalysisSCASoftware Security
0 likes · 8 min read
Software Composition Analysis (SCA): Overview, Challenges, and Implementation
Programmer DD
Programmer DD
Jul 2, 2022 · Information Security

Is 7‑Zip Really Unsafe? Unpacking the ‘Three Sins’ of a Popular Compressor

The article examines a recent call to boycott 7‑Zip, outlining three alleged shortcomings—limited open‑source transparency, unresolved security vulnerabilities, and the developer's nationality—while presenting community rebuttals and suggesting alternative compression tools.

7-ZipSoftware Securitycompression
0 likes · 7 min read
Is 7‑Zip Really Unsafe? Unpacking the ‘Three Sins’ of a Popular Compressor
SQB Blog
SQB Blog
Jun 16, 2022 · Information Security

What the Log4j Disaster Reveals About the Open‑Source Ecosystem

This article uses the 2021 Log4j vulnerability as a lens to explore the nature of open‑source software, its licensing, governance, security implications, and the benefits and responsibilities for individuals and enterprises participating in the open‑source world.

LinuxSoftware Securitylog4j
0 likes · 17 min read
What the Log4j Disaster Reveals About the Open‑Source Ecosystem
21CTO
21CTO
May 6, 2022 · Information Security

Why GitHub Is Mandating Two-Factor Authentication for All Contributors by End‑2023

GitHub announced that, starting in 2023, every code contributor must enable two‑factor authentication or lose the ability to push code, a move aimed at strengthening account security across its massive developer ecosystem despite low current adoption rates.

Developer PracticesGitHubSoftware Security
0 likes · 4 min read
Why GitHub Is Mandating Two-Factor Authentication for All Contributors by End‑2023
JD Tech
JD Tech
Feb 28, 2022 · Information Security

Integrating Functional Security Testing into Daily Test Practices: Concepts, SDL Roles, and Test‑Case Design

This article explains how test engineers can incorporate functional security testing into routine testing by outlining the differences between security and functional testing, describing the Security Development Lifecycle (SDL) responsibilities, and providing concrete test‑case design guidelines for various security scenarios.

SDLSoftware Securityfunctional testing
0 likes · 12 min read
Integrating Functional Security Testing into Daily Test Practices: Concepts, SDL Roles, and Test‑Case Design
Programmer DD
Programmer DD
Jan 1, 2022 · Information Security

How Maven’s New Vulnerability Highlight Helps Prevent Log4j‑Style Exploits

The article explains Maven Central's new "Vulnerabilities" column that highlights known CVEs for each dependency, discusses its relevance to recent Log4j2 risks, and shows how to use the OWASP Dependency‑Check Maven plugin to scan and report vulnerable Java libraries.

JavaOWASP Dependency-CheckSoftware Security
0 likes · 5 min read
How Maven’s New Vulnerability Highlight Helps Prevent Log4j‑Style Exploits
OPPO Amber Lab
OPPO Amber Lab
Sep 14, 2021 · Information Security

Master Fuzz Testing with AFL and Honggfuzz: Step‑by‑Step Guide

This guide walks you through the fundamentals of fuzz testing, demonstrating how to install, configure, and use popular tools like AFL and Honggfuzz on Ubuntu to detect buffer overflows, illegal memory accesses, and other security vulnerabilities in C programs, complete with code examples and result analysis.

AFLC programmingSoftware Security
0 likes · 16 min read
Master Fuzz Testing with AFL and Honggfuzz: Step‑by‑Step Guide
Meituan Technology Team
Meituan Technology Team
Apr 8, 2021 · Information Security

Threat Modeling: Practices, Challenges, and Implementation Guide

Threat modeling is a systematic, cross‑functional practice that identifies design‑level security flaws early, prioritizes mitigations using methods like ASTRIDE, and integrates risk assessment into DevSecOps, despite tool scarcity and process integration challenges, to reduce costs, meet compliance, and improve overall security maturity.

DevSecOpsSecurity ArchitectureSoftware Security
0 likes · 31 min read
Threat Modeling: Practices, Challenges, and Implementation Guide
Efficient Ops
Efficient Ops
Jan 4, 2021 · Information Security

How DevSecOps Is Transforming Secure Software Delivery – 2020 Report Insights

The 2020 DevSecOps Industry Insight Report, released by XuanJing Security and Freebuf Consulting, examines the rapid adoption of DevSecOps in China, highlights survey results from over a thousand IT professionals, outlines a security tool pyramid, and forecasts emerging trends and best practices for agile security.

Agile DevelopmentDevSecOpsIndustry Report
0 likes · 6 min read
How DevSecOps Is Transforming Secure Software Delivery – 2020 Report Insights
21CTO
21CTO
Dec 31, 2020 · Information Security

Which Languages Have the Worst Security Bugs? Veracode’s Latest Report

Veracode’s State of Software Security Volume 11 reveals that, among popular languages, C++ and PHP suffer the most severe vulnerabilities, while JavaScript and Python see rising issues, highlighting the need for developers to prioritize secure coding practices, regular updates, and careful management of third‑party dependencies.

Secure CodingSoftware SecurityVeracode
0 likes · 7 min read
Which Languages Have the Worst Security Bugs? Veracode’s Latest Report
Architects Research Society
Architects Research Society
Aug 9, 2020 · Information Security

Understanding Open Source Software Dependency Security Risks and Available Tools

The article explains how the widespread use of third‑party open‑source components creates a large, often overlooked attack surface, describes the fragmented nature of vulnerability information, and reviews a variety of tools that help organizations detect and manage security risks in their software dependencies.

Software Securitydependency managementinformation security
0 likes · 12 min read
Understanding Open Source Software Dependency Security Risks and Available Tools
Architects Research Society
Architects Research Society
Jul 8, 2020 · Information Security

Top 25 Software Errors (CWE) and Resources for Mitigation

The article presents the CWE Top 25 software errors, detailing each weakness with its ID and description, and provides links to MITRE entries, remediation guidance, and various SANS training resources aimed at helping developers mitigate these common vulnerabilities.

CWEMitigationSANS
0 likes · 17 min read
Top 25 Software Errors (CWE) and Resources for Mitigation
Open Source Linux
Open Source Linux
Jun 24, 2020 · Fundamentals

Why Is the Operating System Market Shifting? A Deep Dive into Global OS Trends and China’s Rise

This article examines the evolution of operating systems from early mainframes to modern desktop, mobile, and cloud platforms, analyzes global and Chinese market shares of Windows, macOS, Linux, Android, and iOS, highlights the rapid growth of domestic Chinese OS projects, and forecasts future opportunities in government, enterprise, and consumer sectors.

ChinaEnterpriseLinux
0 likes · 33 min read
Why Is the Operating System Market Shifting? A Deep Dive into Global OS Trends and China’s Rise
Tencent Cloud Developer
Tencent Cloud Developer
Jun 5, 2020 · Information Security

DevSecOps and Secure Development Lifecycle (SDL): Concepts, Practices, and Implementation

The article explains how DevSecOps extends the Secure Development Lifecycle by embedding security early and throughout CI/CD pipelines, combining threat‑based and vulnerability‑based defenses, automated testing tools such as SAST, DAST, IAST, and SCA, and fostering a collaborative culture of shared responsibility, illustrated by Tencent Cloud’s comprehensive “Golden Pipeline” implementation.

DevSecOpsSDLSecure Development Lifecycle
0 likes · 14 min read
DevSecOps and Secure Development Lifecycle (SDL): Concepts, Practices, and Implementation
21CTO
21CTO
Nov 21, 2019 · R&D Management

From Frontline Engineer to Tech Leader: Key Lessons for Building High‑Performance Teams

The author shares personal insights on transitioning from hands‑on technical work to managing technical teams, covering career progression, skill development, effective hiring, team integration, leadership mindset, and strategies for sustainable growth and collaborative success in security‑focused projects.

Career DevelopmentLeadershipR&D management
0 likes · 14 min read
From Frontline Engineer to Tech Leader: Key Lessons for Building High‑Performance Teams
dbaplus Community
dbaplus Community
Oct 19, 2019 · Information Security

Mastering Enterprise Code Auditing: Strategies, Tools, and Best Practices

This comprehensive guide explains why code auditing is essential for modern enterprises, compares enterprise and white‑hat audits, outlines a seven‑step methodology, and reviews both open‑source and commercial SAST tools with practical case studies across PHP, Node.js, Python, and Go.

DevSecOpsDynamic analysisSAST
0 likes · 24 min read
Mastering Enterprise Code Auditing: Strategies, Tools, and Best Practices
Architects Research Society
Architects Research Society
Jul 17, 2019 · Information Security

Understanding Open‑Source Dependency Security Risks and Available Scanning Tools

This article explains why open‑source components constitute a major attack surface, outlines the fragmented nature of vulnerability information, debunks the myth that open‑source code is inherently safer, and reviews a range of tools—both open‑source and commercial—that help organizations detect and manage security risks in software dependencies.

Software Securitydependency managementinformation security
0 likes · 11 min read
Understanding Open‑Source Dependency Security Risks and Available Scanning Tools
21CTO
21CTO
Jan 11, 2018 · Information Security

What Is Permission? Uncovering the Core of Access Control

This article explains the fundamental nature of permissions as limited authorized access to protected resources, defines what constitutes a resource in software, outlines permission classifications by method and layer, describes the control model using receptor‑ligand analogy, and summarizes the three core components of a permission system.

AuthorizationSoftware Securityaccess control
0 likes · 7 min read
What Is Permission? Uncovering the Core of Access Control
360 Quality & Efficiency
360 Quality & Efficiency
Jun 6, 2016 · Information Security

Software Security Testing: Objectives, Common Vulnerabilities, and Static/Dynamic Approaches

Security testing, performed from near completion to release, verifies that software meets security requirements and quality standards by identifying common vulnerabilities such as DLL hijacking, ASLR/DEP misuse, and heap overflows, and employs static scanning and dynamic testing methods to detect and remediate these issues.

DLL hijackingDynamic analysisSoftware Security
0 likes · 5 min read
Software Security Testing: Objectives, Common Vulnerabilities, and Static/Dynamic Approaches