Marcus Ranum just wrote a piece about Fortify, code review, and why gritting your teeth and trying really hard just isn't going to make your code secure. Read it.
Among other things, the article pretty well qualifies as a Fortify SCA product review. We've had product reviews before, but this one is different because Marcus is not just a software guy, he's a software security guy. He's the first reviewer who really honestly knows how to wield a code review tool and figure out whether or not it does something useful. Since his feedback is mostly positive, I'm going to take this moment to be proud of what we've built. (Insert proud moment here.) Thanks Marcus!
