11–20 of 93 posts
Why would you need a static analyzer for a language that promotes itself as safe out of the box.
Safe Rust is memory safe and data race safe. There are other forms of safety obviously, like overflow safety, numerous forms of confidentiality and security properties, etc.
impl List {
#[ensures(self.len() == old(self.len()) + 1)]
pub fn push(&mut self, elem: i32) {
// TODO
}
}What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
Usually it doesn't matter if devs themselves don't care, because when devops have the management support, they will care to fix that broken build.
What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
On the other hand commercial tools have been more of a mixed blessing but that is probably because every time ive seen them deployed the budget hasnt included sufficient engineering time, training or prof services to cut down huge numbers of false positives.
Why would you need a static analyzer for a language that promotes itself as safe out of the box.
The remaining 30% still need to be tracked down.
What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
I think it varies by industry though.
What are people's experiences with static analyzers at companies? Many people I have spoken with have either never heard of them, or expressed no interest. Usually those same people use dynamic languages like Ruby or Python.
Big tech uses static analyzers a lot. See for example, these projects: - https://fbinfer.com/ ( - https://github.com/google/error-prone - https://github.com/facebook/SPARTA And many others
Earlier quoted context omitted.
It is safe for the 70% of security flaws found out in languages like C and C++. The remaining 30% still need to be tracked down.
I wonder where you got those numbers from.