undefined | Better HN

0 pointsdeadletters2y ago0 comments

And both have existing tools to find those bugs that people often just don't use.

0 comments

Since 1979 with the invention of lint by Stephen Johnson at Bell Labs.

https://en.wikipedia.org/wiki/Lint_(software)

Static analysis as a bugfinding tool has proven to be insufficient, especially for large C++ binaries and JS programs. Both languages are nightmares for precise and scalable analysis.

Coverity exists. They've got a great product. But it doesn't solve the problem.

pjmlp2y ago

It doesn't solve everything, it solves even less when it isn't used.

UncleMeat2y ago

Of course. But these issues will remain near the top of the list indefinitely if people just leverage traditional analysis tools.

I love static analysis. I did my PhD in it. But we'll still be talking about use after free in 2073 if we just try to chase higher K in our analysis implementations.

1 more reply

j / k navigate · click thread line to collapse

0 comments

pjmlp2y ago

Since 1979 with the invention of lint by Stephen Johnson at Bell Labs.

https://en.wikipedia.org/wiki/Lint_(software)

UncleMeat2y ago

Static analysis as a bugfinding tool has proven to be insufficient, especially for large C++ binaries and JS programs. Both languages are nightmares for precise and scalable analysis.

Coverity exists. They've got a great product. But it doesn't solve the problem.

pjmlp2y ago

It doesn't solve everything, it solves even less when it isn't used.

UncleMeat2y ago

Of course. But these issues will remain near the top of the list indefinitely if people just leverage traditional analysis tools.

I love static analysis. I did my PhD in it. But we'll still be talking about use after free in 2073 if we just try to chase higher K in our analysis implementations.

1 more reply

j / k navigate · click thread line to collapse