Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FindBugs project in its current form is dead

mailman.cs.umd.edu

Post reply on HN
Print view View original

21–30 of 121 posts

Re: FindBugs project in its current form is dead

#21

Post by aardvark179 »

justin66 wrote: post #8

I don't have a Twitter account, so maybe I'm missing something about the difficulty here. But the author spent paragraphs describing how the fate of this major thing is largely in the hands of Bill Pugh, he can't reach Bill Pugh via email, maybe his email is expired, etc. etc. can someone please help contact him via phone or twitter or whatever? Why not just create a twitter account and do it yourself? WTF? edit: pre…

I think the problem is that there are numerous ways to contact him, he's just not replying (or not to the current findbugs committers).

Re: FindBugs project in its current form is dead

#22

Post by gaul »

Google error-prone is a good alternative to FindBugs:

https://github.com/google/error-prone

http://errorprone.info/bugpatterns

Pros:

  * has faster cycle times and integrates into compilation workflow
  * emits fewer false positives
  * active maintainers fix issues
  * releases several times per year
Cons:

  * FindBugs has a greater breadth of checks
  * current error-prone releases only work with Java 8

Re: FindBugs project in its current form is dead

#23

Post by aardvark179 »

That's a real shame as I've found FindBugs to be much clearer in its output than many of the commercial offerings (some of which simply wrap FB's output).

I hope they can get a new project off the ground and can start rebuilding. We're approaching a time where JVM static analysis tools are going to have to start making some big changes to support upcoming features, and it will be a pity if some version of FB or a successor isn't there.

Re: FindBugs project in its current form is dead

#24

Post by raphman »

justin66 wrote: post #8

I don't have a Twitter account, so maybe I'm missing something about the difficulty here. But the author spent paragraphs describing how the fate of this major thing is largely in the hands of Bill Pugh, he can't reach Bill Pugh via email, maybe his email is expired, etc. etc. can someone please help contact him via phone or twitter or whatever? Why not just create a twitter account and do it yourself? WTF? edit: pre…

Apparently, some people have been trying this (but only after the e-mail was sent):

https://twitter.com/search?f=tweets&vertical=default&q=%22%4...

Re: FindBugs project in its current form is dead

#25

Post by taeric »

aardvark179 wrote: post #23

That's a real shame as I've found FindBugs to be much clearer in its output than many of the commercial offerings (some of which simply wrap FB's output). I hope they can get a new project off the ground and can start rebuilding. We're approaching a time where JVM static analysis tools are going to have to start making some big changes to support upcoming features, and it will be a pity if some version of FB or a suc…

Coverity was rather impressive. It did merely wrap a subset of FindBugs errors, but that was mainly to show that they were adding to what FindBugs could do. The points of the code that they spotted were always much more clearly explained for why they were problems.

Re: FindBugs project in its current form is dead

#26

Post by wtracy »

stefs wrote: post #14
dangoldin wrote: post #3

What a shame - it caught a few bugs in my code and has definitely made me a better programmer. One of the reasons is that the code is hard to maintain with most open source contributions being small improvements. How have other open source projects handled large scale refactors? Is it as simple as someone creating something new from scratch and then duplicating functionality? Are there examples of large open source p…

> Are there examples of large open source projects that have had ground up rewrites? well, netscape navigator turned into firefox. it cost them dearly (in terms of market share), but there wasn't much of an alternative (joel spolsky might not agree on that).

Arguably two major rewrites: one early in the life of the Mozilla project, when the FOSS community deemed the original Netscape code dump to be nearly unmaintainable, and the second during the creation of Firefox itself (although that was mostly a re-do of the browser chrome, while the core was left untouched).

Re: FindBugs project in its current form is dead

#27

Post by Macha »

raphman wrote: post #24
justin66 wrote: post #8

I don't have a Twitter account, so maybe I'm missing something about the difficulty here. But the author spent paragraphs describing how the fate of this major thing is largely in the hands of Bill Pugh, he can't reach Bill Pugh via email, maybe his email is expired, etc. etc. can someone please help contact him via phone or twitter or whatever? Why not just create a twitter account and do it yourself? WTF? edit: pre…

Apparently, some people have been trying this (but only after the e-mail was sent): https://twitter.com/search?f=tweets&vertical=default&q=%22%4...

Not the first attempt, see this one august 15: https://mobile.twitter.com/HaydenPJones/status/7652868811814...

Re: FindBugs project in its current form is dead

#28

Post by onli »

nickpsecurity wrote: post #4

A million downloads, commercial deployments by 3rd parties, and basically no contributions coming in. The status quo of the open-source model. They should start selling it to companies to finance their own work on it. Or encourage others interested in static analysis to do the same.

The status quo if you are a defunct project without any means to properly accept contributions or even just mention a new release on the homepage maybe. There are many example where open source as a model works, but you can't expect that it will magically solve all problems. Especially if you as a project are not even able to get the basics right. How is that supposed to foster contributions to the project?

Re: FindBugs project in its current form is dead

#29

Post by michaelt »

masklinn wrote: post #19
CraigJPerry wrote: post #15

Sonar, or SonarQube as it's called now, does need more initial config than findbugs. To get a liveable configuration anyway. Once setup though, the quality of analysis is absolutely outstanding.

I guess it depends on the language, or possibly the setup, the python projects I've been part of using SonarQube its reports were worthless busywork (e.g. requirements of docstrings to every method, resolved by adding """ fuck off sonar """ everywhere).

At least with Java, SonarQube checkers can be individually turned on and off at the project level. Isn't that possible with Python?

Re: FindBugs project in its current form is dead

#30

Post by jknoepfler »

pjmlp wrote: post #17
nickpsecurity wrote: post #4

A million downloads, commercial deployments by 3rd parties, and basically no contributions coming in. The status quo of the open-source model. They should start selling it to companies to finance their own work on it. Or encourage others interested in static analysis to do the same.

This is what kind of changed my view on FOSS as a way to make a living. In all the companies I have worked through my career thus far, not a single one has contributed back in any form to the pile of FOSS libraries that they were using.

As with insistence on code quality, useful and careful testing, infrastructure automation, and good design and review practices, I think the culture of giving back has to come from developers who care about their professional ethos.

My team at EvilCorp contributes fixes to several open-source libraries. The reason this happens, though, is that two of our stronger devs said "the correct thing to do is to take the time to get these fixes into mainline," which they did. The answer to the question of "why" we do it isn't "because it increases our team velocity," but because we're software engineers, and that's what good software engineers do whenever possible.

Post reply on HN