3 ms·

I remember an argument with an engineer about static code analysis years ago. Without a trace of irony, he honestly said "I know it's high quality code. I wro

I remember an argument with an engineer about static code analysis years ago. Without a trace of irony, he honestly said "I know it's high quality code. I wrote it. What could a program tell me about it that I don't already know?" You can guess how much of a nightmare his code was to work with. This isn't a comment on the original article or the author at all. Just my experience with a certain type of engineer.

nerdponx 4y ago
There must be a corollary for programmers who have their preferred set of static analysis tools, but bristle in the same manner at new static analysis tools, or other peoples' static analysis tools.
- kibwen 4y ago
  "Have you ever noticed that anybody driving slower than you is an idiot, and anyone going faster than you is a maniac?" ~ George Carlin
- packetlost 4y ago
  I'll give a legitimate example I've had with Python and Mypy. The codebase I work on uses static typing extensively, and largely it's great. However Mypy is... well it fails open badly in obviously incorrect cases. The problem is the teams are by now socialized to trust Mypy and get surprised when very obvious things fail in production because they thought the tool would catch it. This is the real risk of static analysis IMO, putting undue trust in the tool(s).
  - nerdponx 4y ago
    I don't know if this is the same phenomenon, but it's a good lesson on its own. No testing or analysis tool is perfect all the time. That said, I'm curious about the "fails open" cases. Are you using `--strict`?
    - packetlost 4y ago
      We can't use strict because typing was introduced post-hoc and while most of the codebase is covered, not 100% is.
  - TeeWEE 4y ago
    That’s more a problem of moot and python than of static analysis itself. Python is a dynamic language and mypy is as an after thought not a sound static type checker. Better than nothing…would be way more risky not having it. However engineer must understand the shortcomings. I btw gladly switched from python to Kotlin. Makes it so much easier to trust the compiler. Less work for me
Gigachad 4y ago
This guy makes up 90% of the HN comments about how safe C is possible, you just have to pay attention.
packetlost 4y ago
hahaha, my inclination is almost always the exact opposite. Half the things I wrote a year ago are shit and need to be rewritten and I know it and so do all of my users

nerdponx 4y ago

There must be a corollary for programmers who have their preferred set of static analysis tools, but bristle in the same manner at new static analysis tools, or other peoples' static analysis tools.

kibwen 4y ago
"Have you ever noticed that anybody driving slower than you is an idiot, and anyone going faster than you is a maniac?" ~ George Carlin
packetlost 4y ago
I'll give a legitimate example I've had with Python and Mypy. The codebase I work on uses static typing extensively, and largely it's great. However Mypy is... well it fails open badly in obviously incorrect cases. The problem is the teams are by now socialized to trust Mypy and get surprised when very obvious things fail in production because they thought the tool would catch it. This is the real risk of static analysis IMO, putting undue trust in the tool(s).
- nerdponx 4y ago
  I don't know if this is the same phenomenon, but it's a good lesson on its own. No testing or analysis tool is perfect all the time. That said, I'm curious about the "fails open" cases. Are you using `--strict`?
  - packetlost 4y ago
    We can't use strict because typing was introduced post-hoc and while most of the codebase is covered, not 100% is.
- TeeWEE 4y ago
  That’s more a problem of moot and python than of static analysis itself. Python is a dynamic language and mypy is as an after thought not a sound static type checker. Better than nothing…would be way more risky not having it. However engineer must understand the shortcomings. I btw gladly switched from python to Kotlin. Makes it so much easier to trust the compiler. Less work for me

Gigachad 4y ago

This guy makes up 90% of the HN comments about how safe C is possible, you just have to pay attention.

packetlost 4y ago

hahaha, my inclination is almost always the exact opposite. Half the things I wrote a year ago are shit and need to be rewritten and I know it and so do all of my users