3 ms·
I've run several respected static analyzers against several well respected projects and I'm lucky if I get more than 2-3 false positives. In the Argon2 referen
by technion 10y ago
I've run several respected static analyzers against several well respected projects and I'm lucky if I get more than 2-3 false positives.
In the Argon2 reference library, the one alert from Infer was a genuine bug I sent a PR for, followed by one alert from tis-interpreter that was another genuine bug. clang-analyser produces clean output.
It's true that you get so many false positives under OpenSSL it's not feasible to review. I would contend this is an indicator of code quality more than an indicator of poor static analysers.