Detecting code copying at scale with Vendetect

Summary: Trail of Bits released Vendetect, an open-source tool that uses semantic fingerprinting, based on the Winnowing algorithm used by Stanford's MOSS plagiarism detector, to detect copied and vendored code between repositories. The tool also reads version control history to trace vendored code back to its exact source commit, and it flagged the Cheating-Daddy/Glass case in about 10 seconds on a laptop, showing extensive copying despite comment removal and reformatting.
Why it matters: Vendored code inherits latent vulnerabilities from its source, and without tracking the source version you cannot know whether a CVE like Heartbleed affects you when it drops.

Read the original at Trail of Bits Blog ↗