Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

viva64.com

Post reply on HN
Print view View original

1–10 of 130 posts

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#3

Post by nkurz »

Nice paper from 2013, but I was confused at first how it related to the blog. This paragraph just after the abstract explained, but I missed it the first time through:

   The original article in PDF[1] was published at the NCSU COE 
   People site. It was translated and published at our blog 
   by the authors' permission. At the end of the article[2], we 
   added a short section about the PVS-Studio analyzer, where 
   we describe which of the recommendations suggested in the 
   article are or aren't implemented in our tool and why.
[1] http://people.engr.ncsu.edu/ermurph3/papers/icse13b.pdf

[2] http://www.viva64.com/en/b/0335/#ID0EU4CK

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#6

Post by derefr »

I don't know how is why! (And if I learned, then my coworkers wouldn't know how, so until I got everyone else on board, I would be making the bed only to have them jump all over it again.)

Don't tell me to hunt down random third-party tools that none of my coworkers has heard of, that I have to convince them to adopt, and which each solve a little (usually overlapping) bit of the problem so I have to run all of them in series. That way leads to madness, and horrible one-off UIs developed by people more concerned with their tool's special-snowflake analysis algorithm than its output.

Instead, ship an extensible, plugin-based linter with your language's toolchain (e.g. mix for Elixir, lein for Clojure, etc.) Make its output beautiful. Write one or two simple plugins, and make installing lint-plugins as simple as adding something to the project's dependency file. Then I (and everyone else) will use this stuff.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#7

Post by anon1385 »

moru0011 wrote: post #2

no button in the IDE :)

Have you used one of the popular IDEs recently (Visual Studio, Xcode etc)? It's built into most these days.

Everybody I know who actually uses static analysis does so because it's built into their IDE and very easy to use.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#8

Post by j_jochem »

In one of my recent projects, we used SonarQube. I had actually never worked with that tool before. What bothered me most was how it marked things as errors but did not explain _why_ they were wrong. When it comes to code style, there's a lot of room for personal opinion, and this just led to me arguing with the architect about whether something is a false positive or not. That time could have been spent writing actual, working code or more unit tests.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#9

Post by kybernetyk »

anon1385 wrote: post #7
moru0011 wrote: post #2

no button in the IDE :)

Have you used one of the popular IDEs recently (Visual Studio, Xcode etc)? It's built into most these days. Everybody I know who actually uses static analysis does so because it's built into their IDE and very easy to use.

In Xcode at least there's a 'Build & Analyze" command (cmd-shift-b).

What I like to do is to force a deep analyze on every build. Takes a little longer to build but at least I catch some bugs when I introduce them.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#10

Post by tunesmith »

It's possible to ship working dynamically-typed code that is just absolutely littered with problems that static-analysis tools complain about (even to the point of being "accidentally correct"). So then you can spend a bunch of hours making it compliant, and it's a big refactor that takes a while for other people to review/qa/approve, meanwhile the product folks are grousing about the time it's taking away from the sprint when it's not a roadmap feature, and as a programmer you might completely believe it's worth the effort to clean up the code, but you're still having to deal with a lot of friction.
Post reply on HN