No, You Really Can’t – by Mary Ann Davidson
- A customer can’t analyze the code to see whether there is a control that prevents the attack the scanning tool is screaming about (which is most likely a false positive)
- A customer can’t produce a patch for the problem – only the vendor can do that
- A customer is almost certainly violating the license agreement by using a tool that does static analysis (which operates against source code)
With that in mind, a few FAQ-ish explanations:
- Thunder Below! (“whoo boy, must be hot stuff!”)
- Naked Economics (“nude Keynesians!”)***
- Inferno (“even hotter stuff!”)
- At Dawn We Slept (“you must be exhausted from your, ah, nighttime activities…”)
**** I might be exaggerating here. But maybe not.
