3 ms·
Um, Coverity contributes a lot to the open source community through Scan[1]. While Coverity does incorporate Findbugs results, it also has its own analyzer tha
by achou 10y ago
Um, Coverity contributes a lot to the open source community through Scan[1].
While Coverity does incorporate Findbugs results, it also has its own analyzer that does much more interprocedural analysis and tends to be tuned better for fewer false positives and more accurate error messages. Historically at least, part of the reason for incorporating Findbugs was to make it easier to directly compare what Findbugs found with what Coverity's analyzer found. Because every customer wanted to know that.
I have no idea of current figures but historically Java was not a big business for Coverity. Other vendors had much more Java business (and incidentally also incorporated Findbugs results).
Finally, as you can see from the message the Findbugs leadership does not seem unified and easy to collaborate with.
So forgive me but I find your comment and its tone a bit unfair.
[1] https://scan.coverity.com https://scan.coverity.com
- unreal37 10y agoI see you are the founder of Coverity. It might seem unfair, but you stated that "every customer wanted to know that". So that project has value to you.
- achou 10y agoI should be more clear: every customer using Java wanted to know how our custom developed analysis compared with what Findbugs could find. There weren't all that many such customers though (again, historically). A more typical customer was developing in C/C++.
- lowry 10y agoTrue for my organisation as well. Most of the code is C/C++. So it would make business reason to support the community of the open source product that does not directly compete with Coverity while using it to complement the business offer.
- lowry 10y agoCoverity Scan is a marketing tool. As for FindBugs integration... The majority of Coverity issues I deal with are labelled as FindBugs issues.
- achou 10y agoScan finds lots of bugs for open source projects at no cost. Sure it is marketing, but unlike most marketing it also has real value. Not sure I can comment on the results on your own code, but I will say that volume of results is not always correlated with value in static analysis. There are plenty of noisy rules that basically have negative utility if you factor in the time it takes to review each issue. It's a complex balancing act between finding more issues, having fewer false positives, analysis time, understandability of results, and other factors.
- zodiac 10y agoI'm curious, why don't you run findbugs directly rather than (I presume) paying Coverity?
- lowry 10y agoI would, but the business still pays Coverity and I have to regularly check Coverity reports. Simple subordination.
- dman 10y agoPlease release a solution for indie developers / solo developers.