Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

viva64.com

Post reply on HN
Print view View original

81–90 of 130 posts

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#81

Post by dschiptsov »

flohofwoe wrote: post #37
dschiptsov wrote: post #17

Because neither an advanced type system nor static analysis could catch bugs in program logic?) The benefits of static typing (complie-time checks) are grossly exaggerated. If the claims were true, Java itself and Java projects would be much less buggy.)

Have you looked at the clang analyzer that's integrated into Xcode ( http://clang-analyzer.llvm.org/ )? It doesn't catch everything, and sometimes gives false positives, but it is quite amazing how it visualizes problems in the program flow, going through several levels in the call hierarchy, following variable assignments over function calls, etc... in a few cases I was convinced that a problem was a false positive…

Clang's tooling is amazing, not a single word against it. I gave Java as an example intentionally.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#82

Post by crdoconnor »

raz32dust wrote: post #75
crdoconnor wrote: post #68

Earlier quoted context omitted.

>Java code does tend to be much less buggy when compared with dynamic-typed code I only see this happen when both the Java code and the dynamically typed code both have zero tests. IME, once you actually start taking integration testing seriously and actually exercise your code even just a little , the benefits of static typing evaporate pretty quickly.

Then you indirectly agree that java code requires less tests, which means static typing helps!

Nope. The same tests you'd need anyhow to catch logic errors will end up catching type errors.

If a test becomes unnecessary if you have static typing then you should never have written it in the first place. It's a bad test.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#83

Post by crdoconnor »

yeahdude wrote: post #72
rjaco31 wrote: post #67

Earlier quoted context omitted.

if you have to make a dozen of grep to exclude trivial results, it might be a hint there's something wrong with the pertinence of your output or the customizability of your tool

From another perspective, hacking often involves making broken things work better.

From yet another perspective: don't use broken tools.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#84

Post by franzpeterfolz »

Well, I did it the other way around. When my co-workers drove me crazy. I just launched Findbugs on their Repo/Projects and filed some bugs in the Bugtracker. That is just a matter of 5 Minutes to get them down to the ground and show that they are not that kind of Rockstar-Devs they pretend to be.

But never reveal your secret tools!

Well, and if they get curious about your magical Bug-Finding-Skills, they are easy to convince to use these tools. Its a kind of marketing.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#86

Post by SloopJon »

crdoconnor wrote: post #65

Mainly because most of the tool reports freely mix critical issues with stuff that is just opinionated bullshit (e.g. 80 character length lines). When the output is as long as your arm and you have pick through it with a fine toothcomb to find the things that matter (and even they aren't necessarily causes of bugs), the whole idea becomes substantially less appealing.

"Out of the 20 people we interviewed, 14 people expressed the negative impacts of poorly presented output. ... Some of our participants felt, however, that false positives and large volumes of warnings would be less burdensome if the way the output is presented was more user-friendly and intuitive."

Sounds like you're in the majority.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#87

Post by falcolas »

crdoconnor wrote: post #65

Mainly because most of the tool reports freely mix critical issues with stuff that is just opinionated bullshit (e.g. 80 character length lines). When the output is as long as your arm and you have pick through it with a fine toothcomb to find the things that matter (and even they aren't necessarily causes of bugs), the whole idea becomes substantially less appealing.

Guessing you're referring to the infamous Python PEP-8 limitation. Most linters let you trivially change this line length in a way which either affects the linter permanently, or on a per-project basis.

For example, you can get very fine grained control over pylint by asking it to generate a config file, and reading through it (it's remarkably well commented).

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#88

Post by falcolas »

stevedonovan wrote: post #62
pmontra wrote: post #34

I used lint for C some 20 or 25 years ago, then moved to using dynamical languages (Perl, Ruby, JS.) Not much use of static analysis tools for those languages I thought (but for example check https://www.infinum.co/the-capsized-eight/articles/top-8-too... ). I used Java sometimes and took advantage of Netbeans/Eclipse's hints about Java code but I use emacs for everything else (some vim too). I used jslint on a JavaS…

Ditto and likewise - same applies to pylint, which must have been the most opinionated piece of software I've ever used. The trouble is that there's some very useful warnings buried in the opinion spew - warnings which would be an error in other languages.

pylint is also trivially easy to configure to omit most of these stylistic warnings.

I say this as someone who took 10 minutes to generate and configure the pylintrc for a new project. After taking this time, pylint has been quite useful.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#90

Post by HOLYCOWBATMAN »

dschiptsov wrote: post #17

Because neither an advanced type system nor static analysis could catch bugs in program logic?) The benefits of static typing (complie-time checks) are grossly exaggerated. If the claims were true, Java itself and Java projects would be much less buggy.)

>The benefits of static typing (complie-time checks) are grossly exaggerated. If the claims were true, Java itself and Java projects would be much less buggy

I wouldnt call Java an "advanced type system". Take a look at Idris then try to say that with a straight face:

>Because neither an advanced type system nor static analysis could catch bugs in program logic

It certainly does if you indeed use an advanced type system.

Post reply on HN