Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FindBugs project in its current form is dead

mailman.cs.umd.edu

Post reply on HN
Print view View original

91–100 of 121 posts

Re: FindBugs project in its current form is dead

#91

Post by junkster78 »

nickpsecurity wrote: post #4

A million downloads, commercial deployments by 3rd parties, and basically no contributions coming in. The status quo of the open-source model. They should start selling it to companies to finance their own work on it. Or encourage others interested in static analysis to do the same.

Actually there have been PRs. At the moment there are 15 PRs sitting on FindBugs' Github page: https://github.com/findbugsproject/findbugs/pulls

5 of them are over a year old. Most of them had no review by the development team, and many of those that did, got stuck on Bill, for instance, trying to get Travis enabled: https://github.com/findbugsproject/findbugs/pull/48#issuecom...

There is no incentive to contribute to a project in such poor shape.

SonarQube abandoned FindBugs mainly because it was low on activity:

"FindBugs project activity: The activity on the project is quite low and thus the value coming out of it does not come fast enough to satisfy our users."

http://www.sonarqube.org/sonarqube-java-analyzer-the-only-ru...

Re: FindBugs project in its current form is dead

#92

Post by nickpsecurity »

junkster78 wrote: post #91
nickpsecurity wrote: post #4

A million downloads, commercial deployments by 3rd parties, and basically no contributions coming in. The status quo of the open-source model. They should start selling it to companies to finance their own work on it. Or encourage others interested in static analysis to do the same.

Actually there have been PRs. At the moment there are 15 PRs sitting on FindBugs' Github page: https://github.com/findbugsproject/findbugs/pulls 5 of them are over a year old. Most of them had no review by the development team, and many of those that did, got stuck on Bill, for instance, trying to get Travis enabled: https://github.com/findbugsproject/findbugs/pull/48#issuecom... There is no incentive to contribute t…

Does the license not allow forking it with group of people more interested in accepting contributions? It has a bunch of users. If my theory is wrong, it should've forked with a lot of updates by now.

Re: FindBugs project in its current form is dead

#93

Post by junkster78 »

nickpsecurity wrote: post #92
junkster78 wrote: post #91

Earlier quoted context omitted.

Actually there have been PRs. At the moment there are 15 PRs sitting on FindBugs' Github page: https://github.com/findbugsproject/findbugs/pulls 5 of them are over a year old. Most of them had no review by the development team, and many of those that did, got stuck on Bill, for instance, trying to get Travis enabled: https://github.com/findbugsproject/findbugs/pull/48#issuecom... There is no incentive to contribute t…

Does the license not allow forking it with group of people more interested in accepting contributions? It has a bunch of users. If my theory is wrong, it should've forked with a lot of updates by now.

Yes, it's allowed ('though the name is trademarked). However, forking is usually harmful (effort spread thin, divergent APIs, plugins, integration with other tools such as Maven, Gradle, ...).

On that very email chain, once the sitution was stated and as Bill kept on ignoring everyone as he did over the last year and a half, the community hard forked FindBugs and started aligning behind https://github.com/spotbugs/spotbugs

Bill's reappearance is now puzzling. To abandon the fork to go back to FindBugs would require major leadership changes, as confidence on Bill has been shattered. Keeping the fork leaves the project on the same point people tried to avoid in the first place.

Re: FindBugs project in its current form is dead

#94

Post by dmuth »

enraged_camel wrote: post #85
danielheath wrote: post #81

Earlier quoted context omitted.

There is absolutely no reason to expect volunteers to owe you their time or responses. I don't mean to denigrate you, but I must be candid here: demanding work from others without putting in the hard yards yourself is simply not acceptable. Going forward, I would recommend taking a look at your written communication, and make sure that you are being fair and kind. Good luck.

He didn't demand "work", he simply pointed out that hibernating or abandoning a project many people have come to rely on without arranging for others to (at least temporarily) take over is irresponsible and causes a lot of frustration.

Pretty much that. And to elaborate, there is no shame at all asking for help. I can think of a few ways in which to do this:

- If you are the sole maintainer of a project, putting up a note in the README asking for a co-maintainer or someone to take over the project entirely.

- Responding to emails with, "I'm swamped/I don't think I can do this right now, can you help/would you be willing take on this role?" Totally acceptable. There are lots of eager developers out there who would be willing to contribute to an open source project if they could.

- Posting on HN asking if anyone is willing to help out. :-)

I get that sometimes stuff happens in real life--illness, working long hours, taking care of children or family members--these are all perfectly valid reasons for not being able to put in the time needed to work on an open source project. However, the developer community cannot offer its help if said help is not asked for.

Re: FindBugs project in its current form is dead

#95

Post by nickpsecurity »

junkster78 wrote: post #93
nickpsecurity wrote: post #92

Earlier quoted context omitted.

Does the license not allow forking it with group of people more interested in accepting contributions? It has a bunch of users. If my theory is wrong, it should've forked with a lot of updates by now.

Yes, it's allowed ('though the name is trademarked). However, forking is usually harmful (effort spread thin, divergent APIs, plugins, integration with other tools such as Maven, Gradle, ...). On that very email chain, once the sitution was stated and as Bill kept on ignoring everyone as he did over the last year and a half, the community hard forked FindBugs and started aligning behind https://github.com/spotbugs/sp…

In this case, sounds like the source lost interest, a fork didnt have enough to accomplish anything, and now a good project is toast. Despite it being OSS with significant adoption.

Sounds like quite a few precautionary tales in this one.

Re: FindBugs project in its current form is dead

#96

Post by unreal37 »

erikb wrote: post #75
unreal37 wrote: post #53

Earlier quoted context omitted.

It's still not a good sign that it took this level of public attention to get you to reply to the active community on their urgent needs.

You must have paid 4 digits or more for his services then? Otherwise I think you can't demand any attention at all and be happy if you receive it.

I'm not even talking about the software. I'm talking about the people that were the active maintainers who made a few attempts to connect with him over the course of a year, being let down. And the response after that time of "ok, I'm back now" after a Hacker News post hits the front page, without apology or explanation to them.

Re: FindBugs project in its current form is dead

#97

Post by TD-Linux »

mkobit wrote: post #35

Further on in the email chain, it looks like there is momentum for hard forking under another project named 'SpotBugs' [1, 2]. I hope to see the project live on as it has been useful. Other tools like Google's Error Prone and IntelliJ's inspection toolset are awesome, and FindBugs is complimentary to them. [1] https://mailman.cs.umd.edu/pipermail/findbugs-discuss/2016-N... [2] https://github.com/spotbugs/spotbugs

Side note: "hard fork" has a special meaning for Bitcoin and derivatives, but no meaning for a software fork. I've seen that phrase used several times in the comments though - is this a new trend?

Re: FindBugs project in its current form is dead

#98

Post by rootlocus »

aub3bhat wrote: post #84
danielheath wrote: post #81

Earlier quoted context omitted.

There is absolutely no reason to expect volunteers to owe you their time or responses. I don't mean to denigrate you, but I must be candid here: demanding work from others without putting in the hard yards yourself is simply not acceptable. Going forward, I would recommend taking a look at your written communication, and make sure that you are being fair and kind. Good luck.

I don't know why you are being downvoted, but I agree with you. The level of entitlement expressed on this forum is off the charts. This behavior is reflected in this case or in case of RethinkDB or any other startup which is closing down, where the frame of mind or needs of the people who build/maintain are secondary to those of customer/users. Its quite a paradox.

> The level of entitlement expressed on this forum is off the charts.

This is ridiculous. Expecting the maintainer who hasn't contributed for over a year (hasn't given any life signs or shown any interest) to give admin rights to someone who genuinely cares about the project isn't entitlement. It's the absolute minimum he could do to keep the project alive at the expense of other peoples time and effort.

Re: FindBugs project in its current form is dead

#99

Post by needusername »

Seol wrote: post #71
needusername wrote: post #69

Earlier quoted context omitted.

> error-prone is a compiler plugin Can you provide more information on how this is achieved? As far as I know there is no official, supported, portable API for Java compilers. The only thing I'm aware of is APT and anything beyond that would require significant rearchitecture of the existing compilers.

Technically, it's not a compiler plugin - it actually replaces javac by extending JavaCompiler, wrapping it and applying additional verifications without altering the output. Effectively it's introducing its own API for compiler plugins, with those being the checks, very much akin to APT. See https://github.com/google/error-prone/blob/master/core/src/m... for the entry-point. I'm very close to getting out of my depth…

This is not close to a plugin. I don't see why the term plugin is used here. This is misleading people into believing error-prone is using a supported API.

I also don't see how it is "very much akin to APT". APT is an API where the A stands for abstract and the I stands for interface. APT therefore is portable across compilers and supported. error-prone seems to be tied to the current implementation of javac.

It is as if words don't have a meaning anymore, all that matters is how you feel.

I am very reluctant to use such a tool because to me it looks likely that it's going to have similar problems to tools by Google relying on the implementation internal APIs in the past (eg. Android or GAE/J). Supporting new versions of Java is going to require serious amounts of effort and therefore going to be very late if it happens at all.

Re: FindBugs project in its current form is dead

#100

Post by zodiac »

lowry wrote: post #59
achou wrote: post #52

Earlier quoted context omitted.

Um, Coverity contributes a lot to the open source community through Scan[1]. While Coverity does incorporate Findbugs results, it also has its own analyzer that does much more interprocedural analysis and tends to be tuned better for fewer false positives and more accurate error messages. Historically at least, part of the reason for incorporating Findbugs was to make it easier to directly compare what Findbugs found…

Coverity Scan is a marketing tool. As for FindBugs integration... The majority of Coverity issues I deal with are labelled as FindBugs issues.

I'm curious, why don't you run findbugs directly rather than (I presume) paying Coverity?
Post reply on HN