News for hackers. Stuff that matters.
Re:Why Don't Software Developers Use Static Analysis Tools t... by ThePhysicist on Friday June 26, 2015 @04:18AM (#9782963)
Very interesting article! I am developing static code analysis tools for Python myself (https://www.quantifiedcode.com) and have thought a lot about this problem as well. Since we offer a SaaS solution instead of an IDE plugin the boundary conditions are a bit different for us (e.g. we have less strict "realtime" requirements but the feedback time is also longer), but the basic question is the same: Why doesn't everyone use static analysis to improve their code?

After having surveyed most of the available static analysis tools I think that part of the answer is that often the tools simply do not provide enough value for developers, especially those analyzing dynamic languages like Python / Ruby / Javascript (for C++/Java the tooling is much better). We are currently trying to change that by developing a new, data-driven approach to code analysis, which (we hope) should improve the quality of the analyses quite a bit and provide better and more actionable feedback.

Part of the problem is also cultural of course: People have different ideas about what "good code" is and they usually do not like having their code critiqued. Using an automated tool rather than manual code review to check some aspects of code quality can be beneficial though, since it is normally easier to accept harsh feedback from a machine than a human.

Re:Why Don't Software Developers Use Static Analysis Tools t... by oellegaard on Friday June 26, 2015 @07:59AM (#9783711)
It looks like it takes quite a while to analyze :-( It just says Waiting for analysis to start (queue position: 46)