3 ms·
My last job was a fortune 500 that decided to start using a static analyzer on a 20 year old project. Thousands of false positives and less than ten true positi
by colinmhayes 5y ago
My last job was a fortune 500 that decided to start using a static analyzer on a 20 year old project. Thousands of false positives and less than ten true positives after hundreds of hours were spent going through it. Now the codebase was definitely a piece of work which is why there were so many false positives, but there were plenty of "the static analyzer is horrible" false positives too.
- acdha 5y agoYes - I’m not saying that you won’t see false-positives, but I’ve rarely seen a project where it didn’t find real issues, including some that people resisted accepting (including exploitable security holes). If you approach it determined to reject everything, or to blindly follow the tool, you’ll get poor outcomes. If you view it as a tool which can help you improve your code and triage results accordingly, you’ll almost always have better results.
- naasking 5y ago> Thousands of false positives and less than ten true positives after hundreds of hours were spent going through it. Ten true positives could very well be worth thousands of programmer hours if they're severe enough.