<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16587" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=766241915-26022008>If you sell the libraries then you will be forced to
pay. However, if your libraries are available free of charge, then you can use
services such as <A
href="http://opensource.fortifysoftware.com/">http://opensource.fortifysoftware.com/</A></SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=766241915-26022008></SPAN></FONT> </DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> john@threepoundfilms.com
[mailto:john@threepoundfilms.com] <B>On Behalf Of </B>John Ehn<BR><B>Sent:</B>
Tuesday, February 26, 2008 10:14 AM<BR><B>To:</B> McGovern, James F (HTSC,
IT)<BR><B>Cc:</B> specs@openid.net<BR><B>Subject:</B> Re:
OWASP<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV>James,</DIV>
<DIV> </DIV>
<DIV>Considering that the majority of the individuals and organizations that
have created the OpenID libraries do not have access to vast sums of cash to pay
for these applications or services, do you recommend any analysis software that
is low cost or free?</DIV>
<DIV> </DIV>
<DIV>Thanks,</DIV>
<DIV> </DIV>
<DIV>John</DIV>
<DIV><A href="http://extremeswank.com">extremeswank.com</A><BR><BR> </DIV>
<DIV><SPAN class=gmail_quote>On 2/26/08, <B class=gmail_sendername>McGovern,
James F (HTSC, IT)</B> <<A
href="mailto:James.McGovern@thehartford.com">James.McGovern@thehartford.com</A>>
wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">I
would be curious to know if the implementers of the various
OpenID<BR>libraries have used tools such as Ounce Labs (<A
href="http://www.ouncelabs.com">www.ouncelabs.com</A>),<BR>Coverity (<A
href="http://www.coverity.com">www.coverity.com</A>) and others to ensure that
the OWASP Top Ten<BR>(<A href="http://www.owasp.org">www.owasp.org</A>)
doesn't
occur?<BR><BR><BR>*************************************************************************<BR>This
communication, including attachments, is<BR>for the exclusive use of addressee
and may contain proprietary,<BR>confidential and/or privileged
information. If you are not the intended<BR>recipient, any use,
copying, disclosure, dissemination or distribution is<BR>strictly
prohibited. If you are not the intended recipient, please
notify<BR>the sender immediately by return e-mail, delete this communication
and<BR>destroy all
copies.<BR>*************************************************************************<BR><BR>_______________________________________________<BR>specs
mailing list<BR><A href="mailto:specs@openid.net">specs@openid.net</A><BR><A
href="http://openid.net/mailman/listinfo/specs">http://openid.net/mailman/listinfo/specs</A><BR></BLOCKQUOTE></DIV><BR></BODY></HTML>