Top all-time · #9069
GrammaTech
Company blog · grammatech.com/blogsecurityprogramming
GrammaTech is the company blog at grammatech.com, writing about security and programming. Since 2012, 9 different Hacker News readers have linked it 10 times, most often “Finding Heartbleed with CodeSonar”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link GrammaTech pages mainly as product references, such as the CodeSurfer tool page, and in hiring threads for job listings. The comments do not judge the writing itself.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
With over 35 years of experience in software analysis and binary transformation, we deliver cutting-edge cyber security technologies for mission-critical environments.
Most-linked posts?
- Finding Heartbleed with CodeSonar2 people · 2 mentions · first linked 2014-05-03
What Hacker News says?
GrammaTech, Inc. | Ithaca, NY & Madison, WI | REMOTE GrammaTech is in search of several new developers with experience in C/C++ & Java with a preference given to those familiar with static analysis. We have offices in Ithaca, NY and Madison, WI but will consider remote employees for most positions. For more information and a list of open positions: http://www.grammatech.com/careers
Comment linking /careers
on “Ask HN: Who is hiring? (August 2015)”Submitted Defense against leaking ROP gadgets as a story · 3 points
HN discussionGrammaTech, Inc. | Ithaca, NY | Compiler Front-End Engineer GrammaTech is searching for an engineer who has experience with the Clang front end. Not just LLVM; we need someone who knows the parser well. Remote work is possible but relocation to Ithaca is preferred. http://www.grammatech.com/careers/open-positions/compiler-fr... To Apply: Send your résumé via email to recruiting@grammatech.com. Please use reference S…
Comment linking /careers/open-positions/compiler-front-end-engineer
on “Ask HN: Who is hiring? (June 2015)”Submitted The most powerful C/C++ source code analysis systems available today. as a story · 2 points
HN discussionThe payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewrit…
Comment linking /research/products/CodeSurferx86.html
on “Kaspersky: Duqu Trojan uses 'unknown programming language'”Submitted Finding Heartbleed with CodeSonar as a story · 1 points
HN discussionA couple things: - Competitors with Coverity are CodeSonar[1] and Klocwork[2]. I've not seen Klocwork output, but CodeSonar and Coverity are in the same area of quality, with differing strengths. I can not recommend static analysis highly enough if you have a C/C++/Java/C# database. It's very expensive (well into five figures according to Carmack), but how expensive is a bug? What if you have your entire codebase ch…
Comment linking /
on “John Carmack on Static Code Analysis”Submitted Analogies I Have Perpetrated as a story · 1 points
HN discussionThe best tool I have ever used for that is CodeSurfer: http://www.grammatech.com/products/codesurfer/overview.html . It supports slicing operations: Which downstream changes happen if I change this variable? What upstream control structures influence the value of this variable? Great stuff.
Comment linking /products/codesurfer/overview.html
on “Efficiently Browsing Text or Code (esp. with Emacs)”Maybe you just enjoy hyperbole but while part of what you say is correct (finding security vulns in software is unavoidably a bit of a crapshoot) your conclusions are wrong. Finding deep, serious vulns like this in software can currently only be done by human beings. Tools are better at being authoritative but can only find vulns of a given type. For example static analysis is a great fit for any vuln that boils dow…
Comment linking /blog/finding-heartbleed-with-codesonar
on “Quality Software Costs Money – Heartbleed Was Free”