Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

viva64.com

Post reply on HN
Print view View original

51–60 of 130 posts

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#51

Post by karlmdavis »

j_jochem wrote: post #8

In one of my recent projects, we used SonarQube. I had actually never worked with that tool before. What bothered me most was how it marked things as errors but did not explain _why_ they were wrong. When it comes to code style, there's a lot of room for personal opinion, and this just led to me arguing with the architect about whether something is a false positive or not. That time could have been spent writing actu…

I use SonarQube myself and have generally found its rules to make sense after a quick Google, at most.

Aside from its code formatting rules, which are just silly. They're easy enough to modify or turn off, though, so there's that.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#52

Post by verinus »

maccard wrote: post #12
kybernetyk wrote: post #9

Earlier quoted context omitted.

In Xcode at least there's a 'Build & Analyze" command (cmd-shift-b). What I like to do is to force a deep analyze on every build. Takes a little longer to build but at least I catch some bugs when I introduce them.

My compile is already 10 minutes, I don't want to add a static analysis pass to every build thanks.

well then run it on CI/daily builds.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#53

Post by danbruc »

inglor wrote: post #50
M4v3R wrote: post #41

Earlier quoted context omitted.

Don't know about IntelliJ, but XCode does real-time analysis as well, but it also has a mode for deep static analysis, which for example does code path analysis for finding dead code paths, even across methods. This kind of stuff would be hard to perform in real-time.

Why? You'd just keep the code in SSA and diff whenever the user adds code - you need to create the form _once_ but after you've created it diffing it should be reasonably fast - the creation can be done at project creation time and it can be changed on-line and incrementally. I'm not sure if tools actually do it but it definitely sounds possible.

How would maintaining a SSA representation of the code help detecting dead code paths? Doing so requires reasoning about possible truth values of conditions and is in general equivalent to the halting problem and therefore undecidable. You could only spend the cycles available in real time and that will in a certain number of cases be enough to solve the problem but there will also be instances requiring more cycles and instances being undecidable.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#56

Post by maccard »

verinus wrote: post #52
maccard wrote: post #12

Earlier quoted context omitted.

My compile is already 10 minutes, I don't want to add a static analysis pass to every build thanks.

well then run it on CI/daily builds.

That's fine, but making it a default option for all developers on every build wouldn't be suitable for us is what I was saying. I'm fine if it's run on the CI servers, or even if it's a requirement that I submit a "clean" static analysis report with my changes, which can be done by giving me the option (like XCode/Visual studio already do).

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#57

Post by danbruc »

inglor wrote: post #49
danbruc wrote: post #43

Earlier quoted context omitted.

Good static checkers perform pretty deep analyses you can not (yet) do in real time. Real time checking is of course useful but it is no replacement for a deeper static analysis.

A tool like IntelliJ can do deep analysis off-line and in the background and only tell you about the results. This is a good tradeoff between fast feedback and deep analysis.

I don't exactly know which kind of analyses IntelliJ performs but assuming that they are comparable to what ReSharper does they are quite different from what for example Coverity looks for.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#58

Post by glogla »

PinguTS wrote: post #38
geromek wrote: post #33

Earlier quoted context omitted.

I am saying "Developers do not want : 1 - Pay A LOT of money for advanced solutions that are more than AST checkers (hello SonarQube) or big piles of false positives. 2 - Add overhead to their workflows (more than an IDE plugin is harmful, and what happens with those devs not using an IDE?). 3 - Spend time on figuring out if the static analysis results make sense or not, one by one. A typical SCA tool can report hund…

I am from engineering background and not soley a software guy, so forgive me my different view on this topic. I learned, that every error you can fix early on will cost you about 10x to fix in the next stage. All the new principles like Agile have not changed that.

I think the idea is not that it's not worth to fix errors as soon as possible (which it is), but that static analysis tools provide too many false positives and too many non-errors to be useful.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#59

Post by inglor »

danbruc wrote: post #57
inglor wrote: post #49

Earlier quoted context omitted.

A tool like IntelliJ can do deep analysis off-line and in the background and only tell you about the results. This is a good tradeoff between fast feedback and deep analysis.

I don't exactly know which kind of analyses IntelliJ performs but assuming that they are comparable to what ReSharper does they are quite different from what for example Coverity looks for.

Oh yes, they do some static analysis but it's not even close to the level of Coverity, sorry if my initial comment was misleading.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#60

Post by zamalek »

inglor wrote: post #4

ReSharper (on C# in Visual Studio) and Visual Studio itself do perform static analysis and find out bugs like "possible multiple enumerations of IEnumerable" for you pretty readily, developers also use code coverage tools. Still, good article.

ReSharper does lightweight static analysis - I would venture to go as far as to place it into the "code smell analysis" category. Using something like Code Contracts, properly, drastically changes your outlook on static analysis.

ReSharper: you've enumerated this enumerable multiple times. This if statement is redundant. Basically stuff within the scope of a single method.

Code Contracts: you've passed an integer to this function. The function asks that you check that the integer falls into the length of the array that you are also passing in and that it's a multiple of two. Also, the function doesn't promise that it won't return a null value and you are using the result without checking it first. Basically looks at your entire project and can work out code paths across methods.

There's worlds of a difference. ReSharper is definitely useful, but doesn't come close to what proper static analysis can do. If you like what ReSharper is doing for your codebase I thoroughly recommend having a look at Code Contracts (it's a free Microsoft Research project).

Post reply on HN