3 ms·

I have limited experience with them but I think tools like Coverity or Veracode are significantly better, but maybe they are just better at marketing. Coverity

I have limited experience with them but I think tools like Coverity or Veracode are significantly better, but maybe they are just better at marketing. Coverity actually offers free scans for some open-source projects, here's the report for the Linux kernel: https://scan.coverity.com/projects/linux https://scan.coverity.com/projects/linux They have a large list of other projects as well (it seems you can't drill down into individual errors and only see summary statistics though, which sucks): https://scan.coverity.com/projects https://scan.coverity.com/projects I didn't find anything comparable for Veracode, but comparing the Coverity results with a static analyzer like Clang should give you an idea of the effectiveness. It's not a magic bullet (IMHO) but it definitely can find bugs that other tools don't see.

atq2119 8y ago
Coverity is pretty good, but shows quite a lot of false positives in my experience. This may obviously depend on the project, of course. What I really wish for is an easily understandable way to teach these advanced static analysis tools about why something is a false positive, so that the tool can avoid showing the same false positive again in the future when a minor detail of the surrounding code changes.
- UncleMeat 8y ago
  > What I really wish for is an easily understandable way to teach these advanced static analysis tools about why something is a false positive, so that the tool can avoid showing the same false positive again in the future when a minor detail of the surrounding code changes. People have been doing research on this for decades. The problem is that the way that humans understand code and the way that static analysis understands code are wildly different and the root cause of a false positive is either fundamentally not possible to avoid or so far removed from the final analysis that you can't really address it. Static analysis results are often brittle in fundamental but non-obvious ways. For example, a human might think that moving code between two functions shouldn't change much. But when you are using K Context Sensitivity, suddenly just wrapping some code in a helper function will completely fuck your points-to results.

atq2119 8y ago

Coverity is pretty good, but shows quite a lot of false positives in my experience. This may obviously depend on the project, of course. What I really wish for is an easily understandable way to teach these advanced static analysis tools about why something is a false positive, so that the tool can avoid showing the same false positive again in the future when a minor detail of the surrounding code changes.

UncleMeat 8y ago
> What I really wish for is an easily understandable way to teach these advanced static analysis tools about why something is a false positive, so that the tool can avoid showing the same false positive again in the future when a minor detail of the surrounding code changes. People have been doing research on this for decades. The problem is that the way that humans understand code and the way that static analysis understands code are wildly different and the root cause of a false positive is either fundamentally not possible to avoid or so far removed from the final analysis that you can't really address it. Static analysis results are often brittle in fundamental but non-obvious ways. For example, a human might think that moving code between two functions shouldn't change much. But when you are using K Context Sensitivity, suddenly just wrapping some code in a helper function will completely fuck your points-to results.