[adorno]

Depends on what you're trying to catch/avoid. It's very good at fixed-pattern matching and other lightweight techniques. It doesn't have the advanced processor=intensive heuristic algorithms of the big packages, that give them such a bad reputation for slowing your machine down.

When it comes to Windows, which company would understand the code better than the Windows writers themselves? True that, the code has allowed too many viruses and other malware to infect the system, but, the reality is that, Microsoft is now in the business of providing security software, and going forward, I doubt that anybody is going to understand the code and the potential exploits better than the Microsoft analysts/developers/coders.

[dayglored]

> I doubt that anybody is going to understand the code and the potential exploits better than the Microsoft analysts/developers/coders.

Maybe. But maybe they're too close to the code.

I'd feel better if Microsoft were requiring the use of one or two of the high-end third-party static analysis products out there. You know what I mean, the packages that run a quarter of a million bucks or so. The ones the big boys use for code that has to work, like spacecraft code.

Because the last person you want checking code for mistakes is the person who wrote it, and the next to the last is any person who has a vested interest in not finding bugs.

Microsoft might be using someone else's analysis tools, I don't honestly know. But I've never heard of them doing so on Windows, and it would be a big deal if they did, so I assume they don't.

[rockrr]

One thing to keep in mind - Microsoft is huge and diverse and ridiculously competitive. They aren’t exactly “one big happy family” and the spirit of cooperation isn’t quite what one might believe.