Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

I don't know what tone the article title is going for. Is it meant to imply that open source software is somehow buggier than closed source? Or simply that they made open source software better by finding these bugs.

If the former, it's worth noting that these are 10,000 bugs that are visible because the software is FOSS. Closed source software uses code analyzers/linters too. I worked on a piece of proprietary software where we had a giant spreadsheet for the several hundred bugs and other minor issues that flawfinder found on our software. Those will never get disclosed to the public.

View on HN

> I don't know what tone the article title is going for.

Did you really not? Then you have not read enough articles in the viva64 blog. :-)

The tone is always "Static analysis with PVS-Studio is a great way to find bugs in projects and it would be a good way to use PVS-Studio for your projects, too".

Of course this is marketing, that is obvious from the title alone. The open source projects give them a means to post a high numbers of bugs found by their magical product. For a high number they just have to scan more products, they can even decide to omit the projects that didn't trigger much bugs. They can't post the results from paying customers in a marketing stunt like this.

They mention that they let the developers of the open source projects know about the issues they find. I am wondering how much time the developers get to patch up before they post their results.

I will give them the benefit of the doubt and assume its the later and not the former. If someone took a Valgrind substitute for Windows and ran a few game bundles, I would guess that over 90% of them has some kind of detectable bug in them in regard to memory management. Access to uninitiated memory and access to free'ed memory should be detected even if you have no access to the source code.

Out of the 10000 bugs that was mentioned by the article, I wonder how many got rated critical by up stream.

> Closed source software uses code analyzers/linters too.

Some might be surprised just how many don't even do that. Several of the products I've worked on relied solely on bug reports (internal and external). If it compiled and passed QA, it went into the field.

Agree with you. A lot of teams where I worked didn't ever think about testing their code.

So first you say you don't know, then you say "if it is this thing that I completely made up then they are wrong".

Well, that is certainly an interesting way to comment on an article.

I think the message is "regardless of what techniques, tools and analyzers you are using right now, more errors can still be found by applying just another tool".

The tone is the same as always: "buy our product". That's what all viva64 submissions are about.

Do you expect them to say "Don't buy our product"?:)

No but I expect them not to make it look like they just want to help OSS

But they are not even trying. They declare it loud and clear: that's our marketing, but we're happy to help OSS

Reply on news.ycombinator.com