BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//talks.toorcon.net//toorcon-2021//speaker//8VHJFQ
BEGIN:VTIMEZONE
TZID:PST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T100000Z
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T110000Z
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-toorcon-2021-C8BGWG@talks.toorcon.net
DTSTART;TZID=PST:20211012T170000
DTEND;TZID=PST:20211012T175000
DESCRIPTION:Static analysis can be expensive\, time consuming\, full of fal
 se positives\, a pain in the rear to manage multiple languages\, and not v
 ery configurable. But no more! At Slack\, we’ve designed a static analysi
 s program which utilizes one free\, highly configurable tool to scan over 
 60 different codebases in six languages and has saved us over $700\,000 an
 nually. Semgrep\, an open source static analysis engine\, uses highly conf
 igurable rules. Tuning these rules to our specific environment saves devel
 oper time while providing useful guard rails against dangerous code patter
 ns. We’ve been able to reduce false positives by over 80%\, and we’ve re
 moved rules that don’t apply in our environment. Adding a new codebase to
  our scanning pipeline adds almost no additional overhead\; we merely add 
 one line to a file to enable the scans and review new results. Implementin
 g our program this way has allowed us to meet our compliance requirements 
 while providing a useful\, low overhead static analysis program.
DTSTAMP:20260916T002555Z
LOCATION:The Point
SUMMARY:Free as in Beer: Building a low cost static analysis program - Erin
  Browning\, Tim Faraci
URL:https://talks.toorcon.net/toorcon-2021/talk/C8BGWG/
END:VEVENT
BEGIN:VEVENT
UID:pretalx-toorcon-2021-XAQEHG@talks.toorcon.net
DTSTART;TZID=PST:20211013T130000
DTEND;TZID=PST:20211013T150000
DESCRIPTION:We will demo tuning static analysis rules to specific environme
 nts. Attendees will need to download Semgrep\, the static analysis engine 
 our program is based upon\, beforehand. We have tuned our rules extensivel
 y\, which has greatly reduced our false positive rate.
DTSTAMP:20260916T002555Z
LOCATION:The Lawn - Beta
SUMMARY:Free as in Beer: Building a low cost static analysis program (Demo 
 Time) - Erin Browning
URL:https://talks.toorcon.net/toorcon-2021/talk/XAQEHG/
END:VEVENT
END:VCALENDAR