3 ms·

Code coverage and static analysis are such valuable tools, I can't believe they are not used more and more frequently .. it really seems that a lot of open sour

• seren 12y ago
  It seems that Coverity[0] is offering free static analysis to open source projects. Even if it is a marketing move, it will benefit the open source ecosystem in the long run. You'll waste some time analyzing false positive defects, the handful of critical/security error found make it worth it in my opinion. Notably the duplicate "goto fail" in one of the recent apple vulnerability should have triggered the dead code detection. [0] https://scan.coverity.com/ https://scan.coverity.com/
  • AndreyKarpov 12y ago
    The PVS-Studio team also does a great job: http://www.viva64.com/en/a/0084/ http://www.viva64.com/en/a/0084/
• pjmlp 12y ago
  No code should be set live in production without having at least static analysis on the build server validating official builds. Sadly many managers see this as extra cost, rather something that will reduce costs in project lifetime.
• lmm 12y ago
  Using a language with a more powerful type system (e.g. Haskell) you can derive the same benefits as you would from static analysis tools, but integrated with the rest of your development tools, extensible, and supported by other users of the same language (e.g. library writers). So I think most people who appreciate the benefits tend to move on from C (particularly given how large the library ecosystem in safer languages is these days).