This is quite a shock. I worked at Coverity about 7 years ago, but I didn't have much faith in static analysis (now I'm at Microsoft, ironic).
Also a good read: http://www.altdevblogaday.com/2011/12/24/static-code-analysi...
I'm not a fan either.
Although we're a Ruby and JS shop, we take advantage of different services and libraries that perform different checks. In dynamic-language land it's a lot harder to do some of the things that static complication provides, but it's a heck of a lot better than nothing!
Static analysis tools are very pragmatic in a world where better languages aren't adopted very often.
Writing in C/C++ is like asking to be shot in your foot. So you get static analysis, which gives you a modicum of help.
(1) almost all compiled language systems do _some_ static analysis. For example, many compilers and linkers do dead code elimination, and Java and C# must, by spec, do static analyisis to prove that variables won't be used before set.
If you eliminate potential bugs to be found, static analysis is devalued significantly. So while static analysis may seem necessary for C++ code (very buggy, not much safety), it has less value for Java or C# code, where the easy-to-detect bugs and the remaining bugs are much more difficult to find.
As soon as you try to write living software, that is, software able to evolve over time without restarting, static analysis goes out the window. Design by contract and test suites are your friends in this case.
Until better languages are much more common static analysis can save you a lot of time tracking down obscure issues and for that alone it gets my vote. I'll be more than happy to ditch all that for a better way to develop software (not necessarily just better languages) it feels as if we're doing something terribly wrong but I can't quite put my finger on what it is.
It feels as if we're building fragility right into the process from the ground up when in fact we should be doing the opposite.
If you program in C++, you need static analysis. I'm not so sold on it for Java or C#, their is a lot less low hanging fruit in a moderately modern statically typed language.
C++ remains the market maker for the static analysis industry.
i think the future is symbolic execution, which due to a lot of factors is becoming practical
(joking)