Coverity makes a shitload of money off FindBugs. It's annoying they don't contribute back while my organisation pays their most expensive license.
FindBugs project in its current form is dead
41–50 of 121 posts
Re: FindBugs project in its current form is dead
#42Re: FindBugs project in its current form is dead
#43Google error-prone is a good alternative to FindBugs: https://github.com/google/error-prone http://errorprone.info/bugpatterns Pros: * has faster cycle times and integrates into compilation workflow * emits fewer false positives * active maintainers fix issues * releases several times per year Cons: * FindBugs has a greater breadth of checks * current error-prone releases only work with Java 8
It also seems to be automatically run automatically by bazel when building Java code, which was a pleasant surprise.
Re: FindBugs project in its current form is dead
#44Google error-prone is a good alternative to FindBugs: https://github.com/google/error-prone http://errorprone.info/bugpatterns Pros: * has faster cycle times and integrates into compilation workflow * emits fewer false positives * active maintainers fix issues * releases several times per year Cons: * FindBugs has a greater breadth of checks * current error-prone releases only work with Java 8
> current error-prone releases only work with Java 8
I'm assuming that means it will only run on the JVM8, but it can analyze any version of Java code?
Re: FindBugs project in its current form is dead
#45Earlier quoted context omitted.
Yeah, they aren't really big on the 'contributing to open source' thing.
They're about to lose a valuable tool that they'll have to pay money to replace anyhow. It's not hard to make a business case for.
You're assuming they're rational actors. They aren't - at some places (big defense) it's easier to get tens of thousands of dollars of software and compute resources than it is to get OSS approved.
Re: FindBugs project in its current form is dead
#46Earlier quoted context omitted.
As with insistence on code quality, useful and careful testing, infrastructure automation, and good design and review practices, I think the culture of giving back has to come from developers who care about their professional ethos. My team at EvilCorp contributes fixes to several open-source libraries. The reason this happens, though, is that two of our stronger devs said "the correct thing to do is to take the time…
> I think the culture of giving back has to come from developers who care about their professional ethos. On my case that would be the path to be fired. In none of the companies I worked for, doing that would work without going though legal and all the necessary layers to green light it.
You definitely can't skip the step of getting managerial and legal signoff (and no sensible open source project wants a patch that the developer doesn't have the right and authorisation from the employer to contribute). But in better companies it is possible to make that case and get the agreement.
Re: FindBugs project in its current form is dead
#47Coverity makes a shitload of money off FindBugs. It's annoying they don't contribute back while my organisation pays their most expensive license.
Talk them out of renewing and be sure to let the salesperson know that you don't appreciate their ethics. With all the alternatives it's not like you'll be left high and dry.
Re: FindBugs project in its current form is dead
#48Google error-prone is a good alternative to FindBugs: https://github.com/google/error-prone http://errorprone.info/bugpatterns Pros: * has faster cycle times and integrates into compilation workflow * emits fewer false positives * active maintainers fix issues * releases several times per year Cons: * FindBugs has a greater breadth of checks * current error-prone releases only work with Java 8
I really wish it had a maven plugin.
Re: FindBugs project in its current form is dead
#49FindBugs isn’t dead (although my participation had been in hibernation for a while).
I’ve been juggling far too many projects, but I’m now working to move FindBugs back into the active rotation.
I also want announce I'll be working with GrammaTech as part of the Swamp Project, and they will be helping with rebooting the FindBugs project. This has been in the works for a long time (almost a year), and although I’ve known that GrammaTech was likely to win an award, this hasn’t been official and something I could talk about until recently. Was hoping to have something a little more concrete to talk about as far as that goes; but I don’t yet have the information I wanted to share.
Thanks to all the FindBugs fans and supporters who lobbied for me to return to active maintenance of FindBugs. Give me a week to get up to speed on current project needs.
Bill Pugh
Re: FindBugs project in its current form is dead
#50If you're an open source project that's expanded to more than a few people, it's worth going through and making a list of all the various "admin" items your project has accumulated (website? domain name? github? bug tracker? mailing lists? etc) and making sure that for each of them there are at least two people with admin rights and that how to add/remove admins is documented. People do drift away from open source projects (or get run over by the proverbial bus) and single points of failure can make things very awkward.