Re:Astrée Static Analyzer for C and C++
by ryao on Friday February 03, 2023 @01:10AM
(#34637710)
I am interested in using it on OpenZFS. I will probably try the trial in a couple months. Assuming that it does well, it is unfortunate that I will not be able to use it beyond the trial period, since I expect the price to be too expensive.
[ Parent
| on HN ]
That's my point, IMHO this is much more useful than LLM-autocompletion right now.
But there are so few options available, at such a high cost, that nobody uses them.
Abstract interpretation / static analysis can detect lots of defects automatically.
Re:Astrée Static Analyzer for C and C++
by transpute on Friday February 03, 2023 @02:01AM
(#34638029)
Attackers can use trial versions to narrow their search for 0-day defects.
Re:Astrée Static Analyzer for C and C++
by edwcross on Friday February 03, 2023 @03:42AM
(#34638785)
In practice, it's not that easy; fuzzers tend to be more effective for that.
Usually, the time required to properly setup and understand and refine the analysis will take most of the trial period.
These tools are better thought of in the long term, they may require some changes to coding style, and also some knowledge of the code itself.
While they are good for building defenses, they are not so effective for helping attackers. But in the end, yes, they _could_ be used for that.