3 ms·
Yes. These tools are great if you can include them in your nightly build, and if they're accurate enough you can insist on 100% clean runs every night. But a bi
by ekidd 16y ago
Yes. These tools are great if you can include them in your nightly build, and if they're accurate enough you can insist on 100% clean runs every night. But a big dump of cryptic errors, many of false positives, from a commercial vendor with a proprietary tool? If you care about security, you've _got_ to act on it. But I understand why volunteer maintainers get pretty grumpy after the first half-dozen false positives, or if the tool seems to be half-baked.
- EdiX 16y agoThere is another problem with this type of tools, you can read about it here: http://blog.regehr.org/archives/226 http://blog.regehr.org/archives/226 most of what it's found while still a bug may never lead to erratic behaviour, it's hard to estimate the severity of each bug and it's a lot of work to wade through all of them.