3 ms·
I'll give a legitimate example I've had with Python and Mypy. The codebase I work on uses static typing extensively, and largely it's great. However Mypy is...
by packetlost 4y ago
I'll give a legitimate example I've had with Python and Mypy. The codebase I work on uses static typing extensively, and largely it's great. However Mypy is... well it fails open badly in obviously incorrect cases. The problem is the teams are by now socialized to trust Mypy and get surprised when very obvious things fail in production because they thought the tool would catch it.
This is the real risk of static analysis IMO, putting undue trust in the tool(s).
- nerdponx 4y agoI don't know if this is the same phenomenon, but it's a good lesson on its own. No testing or analysis tool is perfect all the time. That said, I'm curious about the "fails open" cases. Are you using `--strict`?
- packetlost 4y agoWe can't use strict because typing was introduced post-hoc and while most of the codebase is covered, not 100% is.
- TeeWEE 4y agoThat’s more a problem of moot and python than of static analysis itself. Python is a dynamic language and mypy is as an after thought not a sound static type checker. Better than nothing…would be way more risky not having it. However engineer must understand the shortcomings. I btw gladly switched from python to Kotlin. Makes it so much easier to trust the compiler. Less work for me