Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

viva64.com

Post reply on HN
Print view View original

11–20 of 130 posts

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#11

Post by maccard »

derefr wrote: post #6

I don't know how is why! (And if I learned, then my coworkers wouldn't know how, so until I got everyone else on board, I would be making the bed only to have them jump all over it again.) Don't tell me to hunt down random third-party tools that none of my coworkers has heard of, that I have to convince them to adopt, and which each solve a little (usually overlapping) bit of the problem so I have to run all of them…

Given that this article is written by/for pvs studio, which works mostly inside visual studio (you can get it to work outside but it seems to require some amount of setup), anyone using visual studio's too chain has a static analysis tool at their disposal. Also, clang has built in static analysis, and I can't speak for gcc.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#12

Post by maccard »

kybernetyk wrote: post #9
anon1385 wrote: post #7

Earlier quoted context omitted.

Have you used one of the popular IDEs recently (Visual Studio, Xcode etc)? It's built into most these days. Everybody I know who actually uses static analysis does so because it's built into their IDE and very easy to use.

In Xcode at least there's a 'Build & Analyze" command (cmd-shift-b). What I like to do is to force a deep analyze on every build. Takes a little longer to build but at least I catch some bugs when I introduce them.

My compile is already 10 minutes, I don't want to add a static analysis pass to every build thanks.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#13

Post by ThePhysicist »

Very interesting article! I am developing static code analysis tools for Python myself (https://www.quantifiedcode.com) and have thought a lot about this problem as well. Since we offer a SaaS solution instead of an IDE plugin the boundary conditions are a bit different for us (e.g. we have less strict "realtime" requirements but the feedback time is also longer), but the basic question is the same: Why doesn't everyone use static analysis to improve their code?

After having surveyed most of the available static analysis tools I think that part of the answer is that often the tools simply do not provide enough value for developers, especially those analyzing dynamic languages like Python / Ruby / Javascript (for C++/Java the tooling is much better). We are currently trying to change that by developing a new, data-driven approach to code analysis, which (we hope) should improve the quality of the analyses quite a bit and provide better and more actionable feedback.

Part of the problem is also cultural of course: People have different ideas about what "good code" is and they usually do not like having their code critiqued. Using an automated tool rather than manual code review to check some aspects of code quality can be beneficial though, since it is normally easier to accept harsh feedback from a machine than a human.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#14

Post by geromek »

I think the reason is fairly simple: even the most evident-no-doubt clear SQL Injection vulnerability found by a SCA tool may never be exploited at all under production (for instance because of a WAF). Then the obvious benefits of static analysis are not that obvious for your employer.

Sometimes we forget companies do not want a perfect code or the best possible well designed software but a product that make them earn money.

My experience is that developers only use those kind of tools if they are forced to by their QA managers of bounded by contract. Programmers usually don't want to fix or track bugs.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#15

Post by andymcsherry »

maccard wrote: post #12
kybernetyk wrote: post #9

Earlier quoted context omitted.

In Xcode at least there's a 'Build & Analyze" command (cmd-shift-b). What I like to do is to force a deep analyze on every build. Takes a little longer to build but at least I catch some bugs when I introduce them.

My compile is already 10 minutes, I don't want to add a static analysis pass to every build thanks.

I would wager 10 minutes is far from the norm for most user's builds in X-Code. That being said, analyzing every build seems a bit much.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#16

Post by AndreyKarpov »

maccard wrote: post #11
derefr wrote: post #6

I don't know how is why! (And if I learned, then my coworkers wouldn't know how, so until I got everyone else on board, I would be making the bed only to have them jump all over it again.) Don't tell me to hunt down random third-party tools that none of my coworkers has heard of, that I have to convince them to adopt, and which each solve a little (usually overlapping) bit of the problem so I have to run all of them…

Given that this article is written by/for pvs studio, which works mostly inside visual studio (you can get it to work outside but it seems to require some amount of setup), anyone using visual studio's too chain has a static analysis tool at their disposal. Also, clang has built in static analysis, and I can't speak for gcc.

It is simply a conspiracy theory :-) PVS-Studio team doesn't belong to the article somehow. However, we knew about it and took into account.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#17

Post by dschiptsov »

Because neither an advanced type system nor static analysis could catch bugs in program logic?)

The benefits of static typing (complie-time checks) are grossly exaggerated. If the claims were true, Java itself and Java projects would be much less buggy.)

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#19

Post by PinguTS »

geromek wrote: post #14

I think the reason is fairly simple: even the most evident-no-doubt clear SQL Injection vulnerability found by a SCA tool may never be exploited at all under production (for instance because of a WAF). Then the obvious benefits of static analysis are not that obvious for your employer. Sometimes we forget companies do not want a perfect code or the best possible well designed software but a product that make them ear…

So, you are saying "Developers don't want to deliver quality."?

If that it true, than I don't want to work with them.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#20

Post by raz32dust »

The problem I have is that there are many cases where the tools are too defensive. If I want to override the tool, I'd typically have to add some annotation in the code to signal to the tool that I am ok with this warning and don't want to see it again. And I, for some reason, just hate adding style checker and static analysis annotations in my code. It just looks ugly to me.
Post reply on HN