On: On the Timing of iOS’s SSL Vulnerability and Apple...

[bsdetector]

I haven't been keeping up, but a year ago Google wasn't using any static analyzer at all on Chrome. They didn't use a real memory access checker like valgrind even to load a blank page, although they came up with a weaker memcheck that mostly works.

Lax development is par for the course at these mega corps.

[asvitkine → bsdetector]

We've been using valgrind bots for a long time on the Chromium project - certainly for much longer than a year.

For example, according to the Wayback Machine, our sites page had an entry about it since 2009:

http://web.archive.org/web/20091123132855/http://www.chromiu...

[bsdetector → asvitkine]

I was thinking of this:

http://www.reddit.com/r/programming/comments/mw2sn/googles_a...

[Nitramp → bsdetector]

I cannot comment on Chrome itself, but internal C++ development at Google has a pretty comprehensive array of checks, both static and dynamic.