Hacker News Reader

Comment by fit2rule | Hacker News Reader

Code coverage and static analysis are such valuable tools, I can't believe they are not used more and more frequently .. it really seems that a lot of open source projects would benefit from a coverage/analysis phase on checkin.

View on HN

Using a language with a more powerful type system (e.g. Haskell) you can derive the same benefits as you would from static analysis tools, but integrated with the rest of your development tools, extensible, and supported by other users of the same language (e.g. library writers). So I think most people who appreciate the benefits tend to move on from C (particularly given how large the library ecosystem in safer languages is these days).

It seems that Coverity[0] is offering free static analysis to open source projects. Even if it is a marketing move, it will benefit the open source ecosystem in the long run. You'll waste some time analyzing false positive defects, the handful of critical/security error found make it worth it in my opinion. Notably the duplicate "goto fail" in one of the recent apple vulnerability should have triggered the dead code detection.

[0] https://scan.coverity.com/

The PVS-Studio team also does a great job: http://www.viva64.com/en/a/0084/

No code should be set live in production without having at least static analysis on the build server validating official builds.

Sadly many managers see this as extra cost, rather something that will reduce costs in project lifetime.

Reply on news.ycombinator.com