Additional work. Developers don't like to deal with false positives. If static analysis tools were like a laser. It's more like a shotgun that throws a bunch of

Additional work. Developers don't like to deal with false positives. If static analysis tools were like a laser. It's more like a shotgun that throws a bunch of shrapnel. Sure it hits some really difficult to find bugs. But developers don't like to have to go through a long list of warnings that aren't really guaranteed to find a valid bug, especially in the applications' context. For example null checking is good, but is it needed if I know it is never really going to be null? Isn't that arguably extra effort of typing and compiling and couple of extra lines to compute? I think we will truly move to better adoption if: 1) We had better configuration for customizing it for our application. 2) More education among developers about what is the correct way to modify the tool's behaviour to aid their work. Help the tool, help them in return. 3) More tools that do specific and general work. Example tools extremely focused on mobile development but also tools that not just help you with correcting design and coding problems but also security vulnerabilities.