Prusti: Static Analyzer for Rust
github.com
Prusti: Static Analyzer for Rust
1–10 of 93 posts
Re: Prusti: Static Analyzer for Rust
#2What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
Re: Prusti: Static Analyzer for Rust
#3This looks good, I'm going to have to try out their work for Go, Gobra, since that's what I'm mostly writing these days.
Re: Prusti: Static Analyzer for Rust
#4What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
Big tech uses static analyzers a lot. See for example, these projects:
- https://fbinfer.com/ (- https://github.com/google/error-prone
- https://github.com/facebook/SPARTA
And many others
Re: Prusti: Static Analyzer for Rust
#5What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
We have some critical systems code in C that I'm going to try to run static analysis on for our Hack Week. There are probably 100 engineers at my company and not much interest in anything beyond Google SRE and language specific release updates. We use Bash, Php, Python, Ruby, Node, C, Go, and Rust.
Re: Prusti: Static Analyzer for Rust
#6What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
A lot of Python teams use a linter that can catch errors like "variable used before defined" as well as matters of code style, and increasingly a static type checker in addition to that (which also does its own set of such checks).
Re: Prusti: Static Analyzer for Rust
#7What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
Static analyzers are free CR in most cases. I highly recommend using it, and do know that in some companies people are unaware of those unfortunately..
Re: Prusti: Static Analyzer for Rust
#8Why would you need a static analyzer for a language that promotes itself as safe out of the box.
Re: Prusti: Static Analyzer for Rust
#9Why would you need a static analyzer for a language that promotes itself as safe out of the box.
Rust claims to make a particular class of bugs more difficult to write. It doesn’t claim to magically eliminate all of them.
Re: Prusti: Static Analyzer for Rust
#10Why would you need a static analyzer for a language that promotes itself as safe out of the box.
It is written in the linked README, but I will state it here.
Rust checks integer overflows at runtime (or not at all, if building for maximum speed). It is safer than not checking at all. But costs performance and can lead to (predictable) crashes.
This tool is a way to prove that overflows can not happen at compile time. Which is extremely hard in the general case.