5 ms·

Unfortunately I have never used one available commercially which meets my needs. We author one in-house.

nickpsecurity 10y ago
Your tool is better than Astree Analyzer and Polyspace? I think you should consider GPLing or licensing it with commercial support. Judging from their prices & effectiveness, you'll make a killing doing better while undercutting their licensing.
- jjnoakes 10y ago
  The problem is usability and licensing costs. Our in-house tool is amazingly powerful and fits our needs but the usability would need improvement (no surprise) and we license some of the utility code we use (which is cheaper if we don't resell our tool).
  - nickpsecurity 10y ago
    You couldn't replace the utility code with something in FOSS? And that's why your company is holding out on a static analyzer better than anything out there? The case for doing something to open that tool is just getting stronger. Btw, what utility tool are you licensing? What makes it irreplaceable? I know of only one in this field that I truly couldn't replace for compilers or static analysis. Even then, there's quite a few that handle the job well enough to not need it. So, I don't use it.
    - jjnoakes 10y ago
      The utility tool has OSS equivalents but we've evaluated them all. None of them have the features we need, and adding them would be person-years of work we can't afford. My hope is to some day open source our internal tool, but we have to wait until the OSS features we need catch up. Until then, we aren't willing to pay the high license fee to redistribute this utility freely. I'm speaking a little cryptically because I'd rather not have this tied directly to any particular company (neither mine nor the one we license this code from). I'm not speaking on their behalves officially; only my own.
      - nickpsecurity 10y ago
        Hmm. Love to know what that tool is but NDA's and policies are what they are. I have an email if you want to send it to me for what advantages it has over similar comparison. Then, on odd chance I see opportunity, I'll nudge someone in direction of trying to bring OSS up to par. No promises it will happen as opportunity has to happen first.

Your tool is better than Astree Analyzer and Polyspace? I think you should consider GPLing or licensing it with commercial support. Judging from their prices & effectiveness, you'll make a killing doing better while undercutting their licensing.

jjnoakes 10y ago
The problem is usability and licensing costs. Our in-house tool is amazingly powerful and fits our needs but the usability would need improvement (no surprise) and we license some of the utility code we use (which is cheaper if we don't resell our tool).
- nickpsecurity 10y ago
  You couldn't replace the utility code with something in FOSS? And that's why your company is holding out on a static analyzer better than anything out there? The case for doing something to open that tool is just getting stronger. Btw, what utility tool are you licensing? What makes it irreplaceable? I know of only one in this field that I truly couldn't replace for compilers or static analysis. Even then, there's quite a few that handle the job well enough to not need it. So, I don't use it.
  - jjnoakes 10y ago
    The utility tool has OSS equivalents but we've evaluated them all. None of them have the features we need, and adding them would be person-years of work we can't afford. My hope is to some day open source our internal tool, but we have to wait until the OSS features we need catch up. Until then, we aren't willing to pay the high license fee to redistribute this utility freely. I'm speaking a little cryptically because I'd rather not have this tied directly to any particular company (neither mine nor the one we license this code from). I'm not speaking on their behalves officially; only my own.
    - nickpsecurity 10y ago
      Hmm. Love to know what that tool is but NDA's and policies are what they are. I have an email if you want to send it to me for what advantages it has over similar comparison. Then, on odd chance I see opportunity, I'll nudge someone in direction of trying to bring OSS up to par. No promises it will happen as opportunity has to happen first.