News for hackers. Stuff that matters.
Re:Disable comments make static analysis tools worse by bluGill on Tuesday July 06, 2021 @10:24AM (#27749039)
You need to regularly audit all your warnings with ever tool upgrade to make sure they still apply. Auditing 10000 issues is too hard, so people will soon not be careful. When there are 10 you can check each quickly enough and ensure they are still valid.

With 10000 warnings that means that people have gotten in the habit of disabling warnings, so how many of them are real. I've tracked production bugs to someone disabling a warning - we regularly disabled that warning for correct reasons, but in the one case it wasn't a false warning.

Thus your disabled warning levels need to be small. Small is somewhat arbitrary, but it needs to be small enough that when the tool says something is wrong you trust it.

There are no comments on this comment yet.