Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I've worked in spaces where static analysis tools were run automatically on every new PR. Trust me, it's not as good as it sounds. Static analyzers are fully incapable of detecting the more nuanced mistakes, so a human touch will still be necessary. Nearly all of the "bugs" found by the static analyzer won't actually be bugs, but you'll have to "fix" them anyway because the reviewer (again, you'll still need one) will demand that all the warnings be cleared before approving your code.

Build a culture that prefers succinct, non-nitpicky code reviews. Static analysis tools only give reviewers more crap to nitpick.



> Nearly all of the "bugs" found by the static analyzer won't actually be bugs

Which static analyzer is this? Every tool I've used only finds bugs the are provable so the false positive rate is essential zero


Plenty of C/C++ static analysis tools have pedantic rules that flag correct code. Effective use of them means going through which rules you want to disable to minimize the unproductive make-work of satisfying the machine.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: