5 ms·

I don't know what tone the article title is going for. Is it meant to imply that open source software is somehow buggier than closed source? Or simply that they

I don't know what tone the article title is going for. Is it meant to imply that open source software is somehow buggier than closed source? Or simply that they made open source software better by finding these bugs. If the former, it's worth noting that these are 10,000 bugs that are visible because the software is FOSS. Closed source software uses code analyzers/linters too. I worked on a piece of proprietary software where we had a giant spreadsheet for the several hundred bugs and other minor issues that flawfinder found on our software. Those will never get disclosed to the public.

cocotino 10y ago
The tone is the same as always: "buy our product". That's what all viva64 submissions are about.
- Pasick 10y ago
  Do you expect them to say "Don't buy our product"?:)
  - cocotino 10y ago
    No but I expect them not to make it look like they just want to help OSS
    - EvgeniyZh 10y ago
      But they are not even trying. They declare it loud and clear: that's our marketing, but we're happy to help OSS
wolfgke 10y ago
> I don't know what tone the article title is going for. Did you really not? Then you have not read enough articles in the viva64 blog. :-) The tone is always "Static analysis with PVS-Studio is a great way to find bugs in projects and it would be a good way to use PVS-Studio for your projects, too".
- wila 10y ago
  Of course this is marketing, that is obvious from the title alone. The open source projects give them a means to post a high numbers of bugs found by their magical product. For a high number they just have to scan more products, they can even decide to omit the projects that didn't trigger much bugs. They can't post the results from paying customers in a marketing stunt like this. They mention that they let the developers of the open source projects know about the issues they find. I am wondering how much time the developers get to patch up before they post their results.
belorn 10y ago
I will give them the benefit of the doubt and assume its the later and not the former. If someone took a Valgrind substitute for Windows and ran a few game bundles, I would guess that over 90% of them has some kind of detectable bug in them in regard to memory management. Access to uninitiated memory and access to free'ed memory should be detected even if you have no access to the source code. Out of the 10000 bugs that was mentioned by the article, I wonder how many got rated critical by up stream.
heywire 10y ago
> Closed source software uses code analyzers/linters too. Some might be surprised just how many don't even do that. Several of the products I've worked on relied solely on bug reports (internal and external). If it compiled and passed QA, it went into the field.
- Pasick 10y ago
  Agree with you. A lot of teams where I worked didn't ever think about testing their code.
eremeevp 10y ago
I think the message is "regardless of what techniques, tools and analyzers you are using right now, more errors can still be found by applying just another tool".
ksk 10y ago
So first you say you don't know, then you say "if it is this thing that I completely made up then they are wrong". Well, that is certainly an interesting way to comment on an article.

cocotino 10y ago

The tone is the same as always: "buy our product". That's what all viva64 submissions are about.

Pasick 10y ago
Do you expect them to say "Don't buy our product"?:)
- cocotino 10y ago
  No but I expect them not to make it look like they just want to help OSS
  - EvgeniyZh 10y ago
    But they are not even trying. They declare it loud and clear: that's our marketing, but we're happy to help OSS

wolfgke 10y ago

> I don't know what tone the article title is going for. Did you really not? Then you have not read enough articles in the viva64 blog. :-) The tone is always "Static analysis with PVS-Studio is a great way to find bugs in projects and it would be a good way to use PVS-Studio for your projects, too".

wila 10y ago
Of course this is marketing, that is obvious from the title alone. The open source projects give them a means to post a high numbers of bugs found by their magical product. For a high number they just have to scan more products, they can even decide to omit the projects that didn't trigger much bugs. They can't post the results from paying customers in a marketing stunt like this. They mention that they let the developers of the open source projects know about the issues they find. I am wondering how much time the developers get to patch up before they post their results.

belorn 10y ago

I will give them the benefit of the doubt and assume its the later and not the former. If someone took a Valgrind substitute for Windows and ran a few game bundles, I would guess that over 90% of them has some kind of detectable bug in them in regard to memory management. Access to uninitiated memory and access to free'ed memory should be detected even if you have no access to the source code. Out of the 10000 bugs that was mentioned by the article, I wonder how many got rated critical by up stream.

heywire 10y ago

> Closed source software uses code analyzers/linters too. Some might be surprised just how many don't even do that. Several of the products I've worked on relied solely on bug reports (internal and external). If it compiled and passed QA, it went into the field.

Pasick 10y ago
Agree with you. A lot of teams where I worked didn't ever think about testing their code.

eremeevp 10y ago

I think the message is "regardless of what techniques, tools and analyzers you are using right now, more errors can still be found by applying just another tool".

ksk 10y ago

So first you say you don't know, then you say "if it is this thing that I completely made up then they are wrong". Well, that is certainly an interesting way to comment on an article.