3 ms·
On the Java end (all though these tools also do C/C++ and other languages maybe even .NET but their speciality from my understanding is Java) is Fortify [now ow
by timtadh 14y ago
On the Java end (all though these tools also do C/C++ and other languages maybe even .NET but their speciality from my understanding is Java) is Fortify [now owned by HP] and IBM AppScan Source [previous Ounce from Ounce Labs].
Both produce high quality output in their domain. Fortify is widely use in the AppSec world.
- johnyzee 14y agoWhat do they give you that you don't get with open source tools like Clover, Findbugs and Checkstyle?
- timtadh 14y agoAccuracy. Detail. They have better analysis engines, which do more complex types of program analysis. The static program analysis field is incredibly deep it takes a lot of engineering to make a world class analysis engine. Just like it takes a lot of effort to make a world class optimising complier. (eg. the Intel C Compiler still out performs GCC despite monumental effort on GCC's side. It takes a long time to build this stuff) They also have better rules sets from what I understand than the open source tools.
- mzl 14y agoWhile the Intel compiler may be better in some/many cases, it is not universal. In my experience (a couple of years ago, C++ code, high-performance requirements), the Intel compiler was quite a bit worse than GCC for code with a lot of branches and abstraction layers. The Microsoft compiler was way better than both. Around 10% faster run-time IIRC.
- raverbashing 14y agoWhat are the main issues with Java code that these tools find?