You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: website/blog/atom-chen-aboutcode/2025-02-04-atom-chen-aboutcode.md
+46-38Lines changed: 46 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,67 +9,75 @@ hide_table_of_contents: false
9
9
10
10
11
11
12
-
[atom](https://github.com/AppThreat/atom) and [chen](https://github.com/AppThreat/chen),
13
-
two open source tools for high-quality code analysis built by the [AppThreat](https://www.appthreat.com/) team, are now part of the non-profit [AboutCode](https://aboutcode.org/)
14
-
organization committed to making open source easier and safer
15
-
to use by building critical open source tools for Software Composition
12
+
[atom](https://github.com/AppThreat/atom) and [chen](https://github.com/AppThreat/chen),
13
+
two open source tools for high-quality code analysis built by the
14
+
[AppThreat](https://www.appthreat.com/) team, are now part of the
15
+
non-profit [AboutCode](https://aboutcode.org/)
16
+
organization committed to making open source easier and safer
17
+
to use by building critical open source tools for Software Composition
16
18
Analysis (SCA) and beyond.
17
19
18
-
“AppThreat started with the simple mission to make high-quality code analysis
19
-
and security tools for everyone,” says [Prabhu Subramanian](https://github.com/prabhu),
20
-
lead maintainer of atom and chen, founder of AppThreat, and creator of other
21
-
open source supply chain security tools like [OWASP CycloneDX Generator (cdxgen)](https://github.com/CycloneDX/cdxgen), [OWASP blint](https://github.com/owasp-dep-scan/blint), and
20
+
“AppThreat started with the simple mission to make high-quality code analysis
21
+
and security tools for everyone,” says [Prabhu Subramanian](https://github.com/prabhu),
22
+
lead maintainer of atom and chen, founder of AppThreat, and creator of other
23
+
open source supply chain security tools like [OWASP CycloneDX Generator
24
+
(cdxgen)](https://github.com/CycloneDX/cdxgen),
25
+
[OWASP blint](https://github.com/owasp-dep-scan/blint), and
While working on a different problem, Prabhu uncovered a lack of high-quality
25
-
code hierarchy analysis libraries and CLI tools. atom and chen were built as
26
-
open source tools to identify likely adversary entry points to improve threat
27
-
modeling, vulnerability management, and risk mitigation. Precisely knowing
28
-
when, where, and how a given library is used in an application or service
28
+
While working on a different problem, Prabhu uncovered a lack of high-quality
29
+
code hierarchy analysis libraries and CLI tools. atom and chen were built as
30
+
open source tools to identify likely adversary entry points to improve threat
31
+
modeling, vulnerability management, and risk mitigation. Precisely knowing
32
+
when, where, and how a given library is used in an application or service
29
33
empowers developers to better understand risks and secure their work.
30
34
31
-
chen, or Code Hierarchy Exploration Net, is an advanced exploration toolkit
32
-
for your application source code analysis to parse and extract code property
35
+
chen, or Code Hierarchy Exploration Net, is an advanced exploration toolkit
36
+
for your application source code analysis to parse and extract code property
33
37
graphs.
34
38
35
-
Powered by the chen library, atom is a novel intermediate representation for
39
+
Powered by the chen library, atom is a novel intermediate representation for
36
40
applications and a standalone tool. The intermediate representation (a network
37
-
with nodes and links) is optimized for operations typically used for
41
+
with nodes and links) is optimized for operations typically used for
38
42
application analytics and machine learning, including slicing and vectoring.
39
43
40
-
“As our projects grew in usage and significance, we felt the need to donate
41
-
these projects to an open source organization committed to the original
42
-
AppThreat mission,” says Prabhu. “AboutCode is that organization.”
44
+
“As our projects grew in usage and significance, we felt the need to donate
45
+
these projects to an open source organization committed to the original
46
+
AppThreat mission,” says Prabhu. “AboutCode is that organization.”
43
47
44
-
AboutCode is a registered non-profit organization that supports the
45
-
development and maintenance of the AboutCode stack of open source tools and
46
-
open data for SCA, including the industry-leading ScanCode, VulnerableCode,
47
-
and DejaCode projects. AboutCode believes that good open source tools and
48
+
AboutCode is a registered non-profit organization that supports the
49
+
development and maintenance of the AboutCode stack of open source tools and
50
+
open data for SCA, including the industry-leading ScanCode, VulnerableCode,
51
+
and DejaCode projects. AboutCode believes that good open source tools and
48
52
open data help you use open source securely and efficiently.
49
53
50
54
With planned tighter integrations with the AboutCode stack, atom and chen will
51
-
provide an even more comprehensive open source solution for the practical
52
-
management of open source and security compliance. This includes advanced code reachability analysis, more efficient triage of vulnerabilities based on true reachability, and deep analysis of call graphs to find where vulnerable code
55
+
provide an even more comprehensive open source solution for the practical
56
+
management of open source and security compliance. This includes advanced code
57
+
reachability analysis, more efficient triage of vulnerabilities based on true
58
+
reachability, and deep analysis of call graphs to find where vulnerable code
53
59
is used.
54
60
55
-
For supply chain analysis, atom can generate evidence of external library
56
-
usage, including the flow of data. OWASP cdxgen uses atom to improve the
57
-
precision and comprehensiveness of the generated CycloneDX SBOM document.
61
+
For supply chain analysis, atom can generate evidence of external library
62
+
usage, including the flow of data. OWASP cdxgen uses atom to improve the
63
+
precision and comprehensiveness of the generated CycloneDX SBOM document.
58
64
59
-
For vulnerability analysis, atom describes vulnerabilities with evidence of
60
-
affected symbols, call paths, and data flows to enable variant and
65
+
For vulnerability analysis, atom describes vulnerabilities with evidence of
66
+
affected symbols, call paths, and data flows to enable variant and
61
67
reachability analysis at scale.
62
68
63
-
“The next frontier in vulnerability management is deep vulnerable code
64
-
reachability analysis and taint analysis to discover new vulnerabilities,”
65
-
says AboutCode lead maintainer Philippe Ombredanne. “atom and chen are the
66
-
fundamental blocks to enable the construction of a FOSS solution to better
69
+
“The next frontier in vulnerability management is deep vulnerable code
70
+
reachability analysis and taint analysis to discover new vulnerabilities,”
71
+
says AboutCode lead maintainer Philippe Ombredanne. “atom and chen are the
72
+
fundamental blocks to enable the construction of a FOSS solution to better
67
73
triage vulnerabilities and avoid vulnerability fatigue.”
68
74
69
-
Building upon atom and chen joining, AboutCode will adopt an open governance
70
-
model, drawing from best practices established by other organizations
75
+
Building upon atom and chen joining, AboutCode will adopt an open governance
76
+
model, drawing from best practices established by other organizations
71
77
committed to open source software, prioritizing transparency, inclusivity, and
72
78
community-driven development. A technical advisory group (TAG) will be formed
73
79
to ensure project development addresses the needs of the wider community.
74
80
75
-
Want to get involved? Join the AboutCode [Slack](https://join.slack.com/t/aboutcode-org/shared_invite/zt-1paqwxccw-IuafuiAvYJFkTqGaZsC1og) or [Gitter](https://app.gitter.im/#/room/#aboutcode-org_discuss:gitter.im) to chat with the community.
81
+
Want to get involved? Join the AboutCode [Slack](https://join.slack.com/t/aboutcode-org/shared_invite/zt-1paqwxccw-IuafuiAvYJFkTqGaZsC1og)
82
+
or [Gitter](https://app.gitter.im/#/room/#aboutcode-org_discuss:gitter.im)
- Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
4
4
- Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt. Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem. Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit laboriosam, nisi ut aliquid ex ea commodi consequatur? Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse quam nihil molestiae consequatur, vel illum qui dolorem eum fugiat quo voluptas nulla pariatur?
- Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
4
4
- Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt. Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem. Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit laboriosam, nisi ut aliquid ex ea commodi consequatur? Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse quam nihil molestiae consequatur, vel illum qui dolorem eum fugiat quo voluptas nulla pariatur?
- Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
4
+
- Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt. Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem. Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit laboriosam, nisi ut aliquid ex ea commodi consequatur? Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse quam nihil molestiae consequatur, vel illum qui dolorem eum fugiat quo voluptas nulla pariatur?
0 commit comments