jmostert2
Using patented technology without a license from the patent holder is illegal. On the other hand, you can't be sued unless people know you're doing something wrong. In-house technology that runs afoul of patents is therefore pretty safe, provided all the employees can be trusted... The moment you start exporting your technology, though, you're in trouble.
Making software open source does unfortunately not "avoid the hassle of patents". Whether your software is proprietary or open source, it can't use patents without permission. Conversely, you can hold patents on software distributed as open source -- although there would be precious little point to that, but maybe someone with an original licensing idea can correct me on that. In any case, a lot of licenses (most prominently the GPL) simply forbid this construction: if you release the software as "open", you implicitly grant everyone a license to use whatever patented technology you've included. Obviously, this can only apply to your own patents or patents you're allowed to re-license.
So: if you don't intend to publicize and you're worried about patents -- don't publicize. Conversely, if you do intend to go public, invest in good legal help first that specializes in IP. Checking your product for patents is hard, as is drawing up strategies for dealing with claimants. Nothing would be more disheartening than pouring a lot of effort in a product you will not be able to ship because a third party asks an exorbitant price for their patent use or refuses to license outright. They might buy your product from you, but that doesn't give you a startup.
This is not a question of "manning up", really (it's not like you can study real hard and then you've worked it out), it's one of economics. I have no idea how expensive the patenting business is, but TANSTAAFL in any case.
Also, analysis is only as good as what you know to analyse. Calling a memory analysis "naive" because it bases itself only on the system allocation/deallocation routines (which are, after all, the logical starting point for any such analysis) is just silly. Sure, the analyzer could have been extended to know about BSTR caching, but there's obviously no limit to the amount of cleverness you need to build in to properly analyze everything this way. Any sufficiently advanced cache is indistinguishable from a memory leak, that's sort of the point.
It's scary when your government is so obviously looking out for itself, rather than you, and failing to even see the difference. After all, what's good for the government is good for the people, eh?
Still, "dumb" sounds less chest-beating than "humble" (ironically enough) so if you think you're not humble enough about being humble, by all means start calling yourself dumb instead. :-)
But even though refactoring is supposed to be perfectly mechanical and "harmless" (especially when supported with unit tests) I'll usually throw away my refactoring, because the risk of breaking the existing code is just too high. It depends on how invasive the new feature is -- if I'm going to have to change a lot to get it done anyway, I might as well incorporate the refactorings. But if the change literally is finding the right position to add a single line of code, no way I'm going to change things once I find it.
When it's clear that adding even simple features takes an extraordinary amount of time because the code is that hard to understand and maintain, getting/making time for proper refactoring is easier, but it's worthwhile even as a way of creating a mental model.
I've never tried unit tests to figure out the semantics of existing code, though, even if it seems obvious in retrospect. I think the code base would have to become very complicated indeed before I go into full scientist mode and construct hypotheses on the semantics and verify them with unit tests. If the code is a tangled mess, it could also be tough to extract the proper bits to test on and/or set up a test environment complete enough for that.