4 ms·

Re. #1 It sounds to me like the issue isn't that false positives exist (you aren't ever going to fully get rid of them), it's that the SA tools need easy "esca

Re. #1 It sounds to me like the issue isn't that false positives exist (you aren't ever going to fully get rid of them), it's that the SA tools need easy "escape hatches" for those false positives. Even something as simple as an editor plugin to let you click on a specific "error" or "warning" and click "silence" to add a magic comment or something to explicitly "allow" the line/function/file. It reduces the amount of extra work from a false positive to next to nothing, it still can and will catch issues before they hit production, and it can make iffy-code more explicit (The added magic comment essentially saying "yes, i did mean to do that").

namibj 9y ago
The PHP I write using Jetbrains IDE, with the most extensive static analysis plugin I could find, has that about 5 keystrokes away when you have the cursor on the sqiggly part. It's about the same keystrokes +-2 or so (navigation), to list all occurrences of that specific warning. So yes, what you ask for is already a thing in (more or less) standard tooling.
WalterBright 9y ago
1. The magic comments are specific to which analysis tool you're using, so don't work well with portable code. 2. Those magic comments are put in the source code, meaning they uglify the code in github, etc. Of course, one could create a separate database for the annotations, but that adds another layer of complexity for the users to prevent its use.
- Klathmon 9y ago
  I disagree. They are as portable as the code is, yes they might only work with a single language requiring another "format" for other linters in other languages, but they will stay with the code wherever it goes. And they aren't "uglifying" the code any more than type annotations or variable names. They are an additional hint to the user and the system about what a specific line or block of code is doing. They are just an annotation that the compiler ignores (for the most part).

namibj 9y ago

The PHP I write using Jetbrains IDE, with the most extensive static analysis plugin I could find, has that about 5 keystrokes away when you have the cursor on the sqiggly part. It's about the same keystrokes +-2 or so (navigation), to list all occurrences of that specific warning. So yes, what you ask for is already a thing in (more or less) standard tooling.

WalterBright 9y ago

1. The magic comments are specific to which analysis tool you're using, so don't work well with portable code. 2. Those magic comments are put in the source code, meaning they uglify the code in github, etc. Of course, one could create a separate database for the annotations, but that adds another layer of complexity for the users to prevent its use.

Klathmon 9y ago
I disagree. They are as portable as the code is, yes they might only work with a single language requiring another "format" for other linters in other languages, but they will stay with the code wherever it goes. And they aren't "uglifying" the code any more than type annotations or variable names. They are an additional hint to the user and the system about what a specific line or block of code is doing. They are just an annotation that the compiler ignores (for the most part).