LGTM.com

» see lgtm.com as it lived, on the wayback machine

~ the eulogy ~

If you read GitHub READMEs between 2017 and 2022 you saw a small badge near the top that said lgtm and gave the project a grade. I read a lot of READMEs in those years, the way any engineer does when picking a dependency, and the badge was one of the signals you glanced at without thinking about who was computing it. The answer was a company in Oxford.

Semmle was founded in December 2006 by Oege de Moor, who had spent two decades teaching computer science at Oxford before leaving to commercialize an idea from his research: treat a codebase as a database and let people write queries against it. The query language was called QL. You could ask it for every place a tainted value reaches a dangerous call, across millions of lines, in one expression. Accel put $8 million in during September 2014 and a larger round followed in August 2018.

LGTM.com arrived in 2017 as the free public instance of that engine, aimed at open source. It pulled in projects from GitHub, analyzed every commit, raised alerts on pull requests, and gave you a query console to run your own QL against real code. By August 2018 it was watching more than 80,000 projects, which made it one of the largest continuously analyzed corpuses of source anybody had.

GitHub acquired Semmle on 18 September 2019 and the technology went where acquisitions go: QL became CodeQL, CodeQL became the engine inside GitHub code scanning, and the standalone site turned into a parallel product the same company no longer needed. On 15 August 2022 GitHub published the plan. Sign-ups and new repositories closed at the end of that month, the analyzers stopped fetching commits at the end of November, and on 16 December 2022 the whole site went off, including the badges that thousands of READMEs were still pointing at.

~ the dossier ~

~ a query language for bugs ~

Most static analyzers of that era shipped you a fixed list of checks and an argument about false positives. QL shipped you the ability to write the check. Once a researcher found one bug, the interesting move was to generalize the pattern into a query and run it over 80,000 projects to see who else had written the same mistake, which the industry later started calling variant analysis. LGTM.com was the public place where that was possible without buying anything.

~ the CVEs ~

The lgtm.com blog was where Semmle published what it caught, and some of it was serious. The Apache Struts remote code execution tracked as CVE-2018-11776 came out of their queries in August 2018, a year after Struts had already cost Equifax its customer database. That October they published a kernel-level remote code execution in Apple's XNU ICMP handling, CVE-2018-4407, which put the company's domain name on the front page of Hacker News for a day.

The badge in your README and the kernel bug on the front page were coming out of the same engine. Semmle kept publishing that way until the acquisition, and a denial of service in Facebook's Fizz TLS library, CVE-2019-3560, went up on the same blog in March 2019.

~ the badges ~

The long tail of a shutdown like this is measured in open issues. Through the autumn of 2022 the same ticket appeared across thousands of repositories, filed by maintainers noticing a dead image in their README or a workflow that no longer ran. fonttools and vim both carried one, and so did most of the projects that had wired themselves in. GitHub softened it by opening pull requests that added a code scanning workflow in place of the old integration, which is a more careful exit than most retirements get.

What is actually gone is the public query console and the historical results behind it, since GitHub said plainly that history was not coming along. lgtm.com itself still resolves today, and it sends you straight to the blog post announcing its own removal. The death notice is the only tenant left at the address.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »