News for hackers. Stuff that matters.

A comment on Sonatype Lift – a unified code analysis platform. Parent comment

Re:Sonatype Lift – a unified code analysis platform by CodeBrad on Friday June 25, 2021 @05:29PM (#27636505)
> We also focus very closely on ensuring our tools have low false positive rates and so we tend to have less noisy output.

What kind of things does lift do to ensure lower false positives?

[ Parent | on HN ]
Re:Sonatype Lift – a unified code analysis platform by stephen-magill on Monday June 28, 2021 @09:54AM (#27661997)
We closely monitor the "fix rate" -- what percentage of issues reported by Lift are ultimately fixed by developers. If the fix rate for a particular tool or type of rule is too low, then we modify how we configure and run the tool to eliminate the false positives we're seeing. It's very much like what Google reports doing internally in their use of ErrorProne (where they require all rules to have a 90%+ fix rate).
[ Parent | on HN ]