Commercial software more secure than open source, finds report

Defect density improvements

The report highlights results from several popular, open source Java and C# projects that have joined the Coverity Scan service since March 2013.

Since its inception nine years ago, the Coverity Scan service has analysed billions of lines of code, and has reviewed more than 5,100 open source projects – including C/C++ projects.

The Coverity Scan service has helped developers find and fix more than 240,000 defects since 2006.

As detailed in the latest report, nearly 152,000 defects were fixed in 2014 alone, which is more than the total number found by the service between 2006 and 2013.

The latest report also shows that defect density (defects per 1,000 lines of code) of open source code and commercial code has continued to improve since 2013.

Open source code defect density improved from 0.66 in 2013 and to 0.61 in 2014, while commercial code defect density improved from 0.77 to 0.76.

According to OpenSSL co-founder Tim Hudson, the Coverity Scan service helped to catch newly discovered defects and highlight where other issues, such as the Heartbleed bug, might exist. Since Heartbleed, OpenSSL has fixed 302 defects found by Coverity Scan, and now has a 0.21 defect density.

Speed and security

The latest Coverity report shows that operating system Linux remains a benchmark for static analysis defect density. Since joining the Coverity Scan service in 2006, Linux has retained its commitment to quality, which remains a key focus, the report said. 

During 2014, Linux used the Coverity Scan service to find and fix more than 500 high-impact defects, including resource leaks, memory corruptions and uninitialised variables.

“As a whole, software quality and security are improving, but neither open source nor commercial standards are complete or conclusive enough to catch everything,” said Zack Samocha, director of marketing for the software integrity group at Synopsys.

“As software projects are being pushed to market faster than ever before, developers need to balance security with speed. As more of these projects use systems like Coverity Scan, we expect to see continued improvement in open source and commercial code security throughout 2015,” he said.

The report makes the assertion that the software industry as a whole must do a better job of balancing security with development speed and feature improvements.

“Developers should use a combination of tools, compliance standards and best-practice principals to produce software that is both high quality and secure – rather than one or the other,” the report said.