Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FindBugs project in its current form is dead

mailman.cs.umd.edu

Post reply on HN
Print view View original

71–80 of 121 posts

Re: FindBugs project in its current form is dead

#71

Post by Seol »

needusername wrote: post #69
Seol wrote: post #63

Earlier quoted context omitted.

Also, error-prone works in a fundamentally different way to FindBugs: error-prone is a compiler plugin, whereas Findbugs is an after-the-fact static analyser. This means, for example, you can include dependencies on the codebase you're analysing in your findbugs checks, but not in error-prone. This turns out to be really quite relevant if you're building domain-specific static analysis checks, as opposed to just runn…

> error-prone is a compiler plugin Can you provide more information on how this is achieved? As far as I know there is no official, supported, portable API for Java compilers. The only thing I'm aware of is APT and anything beyond that would require significant rearchitecture of the existing compilers.

Technically, it's not a compiler plugin - it actually replaces javac by extending JavaCompiler, wrapping it and applying additional verifications without altering the output. Effectively it's introducing its own API for compiler plugins, with those being the checks, very much akin to APT.

See https://github.com/google/error-prone/blob/master/core/src/m... for the entry-point.

I'm very close to getting out of my depth here though :)

Re: FindBugs project in its current form is dead

#72

Post by icebraining »

tom9729 wrote: post #32
michaelt wrote: post #29

Earlier quoted context omitted.

At least with Java, SonarQube checkers can be individually turned on and off at the project level. Isn't that possible with Python?

It's possible with all of the languages. Perhaps static analysis is just difficult with Python?

Static analysis is certainly difficult in Python, but you can still do a lot better than "missing docstring".

Re: FindBugs project in its current form is dead

#73

Post by icebraining »

batbomb wrote: post #38
wtracy wrote: post #26

Earlier quoted context omitted.

Arguably two major rewrites: one early in the life of the Mozilla project, when the FOSS community deemed the original Netscape code dump to be nearly unmaintainable, and the second during the creation of Firefox itself (although that was mostly a re-do of the browser chrome, while the core was left untouched).

It was Phoenix -> Firebird -> Firefox.

Those were just name changes, the rewrites were Netscape → Mozilla Suite → Phoenix/Firebird/Firefox.

Re: FindBugs project in its current form is dead

#74

Post by whitef0x »

nickpsecurity wrote: post #39
onli wrote: post #28

Earlier quoted context omitted.

The status quo if you are a defunct project without any means to properly accept contributions or even just mention a new release on the homepage maybe. There are many example where open source as a model works, but you can't expect that it will magically solve all problems. Especially if you as a project are not even able to get the basics right. How is that supposed to foster contributions to the project?

"The status quo if you are a defunct project " Most successful projects in FOSS with many downloads get virtually no contributions or financial support back. Even the largest ones have an enormous user to contributor ratio with almost all benefits going to the users. Therefore, it's the status quo for open-source in general. Those getting tons of contributions and development without a company behind them are extreme…

The article I think you are talking about is this one https://medium.com/@nayafia/how-i-stumbled-upon-the-internet... by Nadia Eghbal.

She never ended up finding a solution to the problem and instead ended up joining GitHub as a opensource developer advocate (or something similar to that).

Re: FindBugs project in its current form is dead

#75

Post by erikb »

unreal37 wrote: post #53
billpugh wrote: post #49

FindBugs isn’t dead (although my participation had been in hibernation for a while). I’ve been juggling far too many projects, but I’m now working to move FindBugs back into the active rotation. I also want announce I'll be working with GrammaTech as part of the Swamp Project, and they will be helping with rebooting the FindBugs project. This has been in the works for a long time (almost a year), and although I’ve kn…

It's still not a good sign that it took this level of public attention to get you to reply to the active community on their urgent needs.

You must have paid 4 digits or more for his services then? Otherwise I think you can't demand any attention at all and be happy if you receive it.

Re: FindBugs project in its current form is dead

#76

Post by winteriscoming »

unreal37 wrote: post #53
billpugh wrote: post #49

FindBugs isn’t dead (although my participation had been in hibernation for a while). I’ve been juggling far too many projects, but I’m now working to move FindBugs back into the active rotation. I also want announce I'll be working with GrammaTech as part of the Swamp Project, and they will be helping with rebooting the FindBugs project. This has been in the works for a long time (almost a year), and although I’ve kn…

It's still not a good sign that it took this level of public attention to get you to reply to the active community on their urgent needs.

I agree. It's also odd that this clarification of the project status has been posted here now and there has been no reply to that thread in (what I think is) the official mailing list, which has been going on for around a week, where people have been trying to get in touch with him.

Re: FindBugs project in its current form is dead

#77

Post by viraptor »

billpugh wrote: post #49

FindBugs isn’t dead (although my participation had been in hibernation for a while). I’ve been juggling far too many projects, but I’m now working to move FindBugs back into the active rotation. I also want announce I'll be working with GrammaTech as part of the Swamp Project, and they will be helping with rebooting the FindBugs project. This has been in the works for a long time (almost a year), and although I’ve kn…

I'm a bit confused why you decided to respond to HN, but not to the offical mailing list. Even if just with a copy of this text...

Re: FindBugs project in its current form is dead

#78

Post by winteriscoming »

erikb wrote: post #75
unreal37 wrote: post #53

Earlier quoted context omitted.

It's still not a good sign that it took this level of public attention to get you to reply to the active community on their urgent needs.

You must have paid 4 digits or more for his services then? Otherwise I think you can't demand any attention at all and be happy if you receive it.

I have been involved in open source and non-commercial, volunteer driven projects for at least a decade. It's true that it's not right to demand volunteers who spend their time on the projects to answer questions. However, in this case, having read the mailing list thread and even the parent post to which you replied, I don't believe anyone is _demanding_ anything from the project owner.

People who are passionate about a project, as a user or contributor, do tend to ask what the status/roadmap of a project is. At least in open source projects I contribute to, that's not considered as demanding something from the project leaders, just because no one has paid for the project.

IMO, there are times where it's valid to state that no one has paid for the project so aren't entitled to anything, but I don't think this case is a valid one. I've seen this statement being used many times with open source projects and such project usually tend to lose sight that users are a central part of open source projects.

Re: FindBugs project in its current form is dead

#79

Post by kylebrown »

erikb wrote: post #75
unreal37 wrote: post #53

Earlier quoted context omitted.

It's still not a good sign that it took this level of public attention to get you to reply to the active community on their urgent needs.

You must have paid 4 digits or more for his services then? Otherwise I think you can't demand any attention at all and be happy if you receive it.

According to the website, FindBugs was partially funded by a couple of NSF grants. So US taxpayers did indirectly pay for his services.

Re: FindBugs project in its current form is dead

#80

Post by nickpsecurity »

whitef0x wrote: post #74
nickpsecurity wrote: post #39

Earlier quoted context omitted.

"The status quo if you are a defunct project " Most successful projects in FOSS with many downloads get virtually no contributions or financial support back. Even the largest ones have an enormous user to contributor ratio with almost all benefits going to the users. Therefore, it's the status quo for open-source in general. Those getting tons of contributions and development without a company behind them are extreme…

The article I think you are talking about is this one https://medium.com/@nayafia/how-i-stumbled-upon-the-internet... by Nadia Eghbal. She never ended up finding a solution to the problem and instead ended up joining GitHub as a opensource developer advocate (or something similar to that).

Yeah that's it. Thanks. Unusually thorough survey in terms of categories and paying attention to stuff other than Red Hat and Linux. ;)
Post reply on HN