Conversation

This Tweet was deleted by the Tweet author. Learn more

Replying to

Has to do with the style of code as well as the libraries you link to. The use of unbounded structures and imprecisely tracked memory objects adds to that mix In order for static analysis to be useful, code has to be written to allow for deep analysis

Replying to

Compare bugs found with ASan/UBSan/TSan + testing / fuzzing vs. static analysis. Static analysis barely finds anything. It also tends to have lots of false positives, which are harmful, and encourage making changes to the code which can and often does lead to introducing bugs.

Replying to

The Debian key generation issue is a particularly well known example, but there are lots of others. Lots of projects have had bad experiences with it. Here's one: sqlite.org/testing.html#s.

Replying to

"Static analysis has found a few bugs in SQLite, but those are the exceptions. More bugs have been introduced into SQLite while trying to get it to compile without warnings than have been found by static analysis."

Replying to

It's like that for Linux kernel as well. There are classes of bugs that defy casual static analysis and you have to basically make your own runtime correctness checking tools (lockdep etc)

This Tweet was deleted by the Tweet author. Learn more

Replying to

Choosing safe architectures and tools is obviously part of good design. Those design choices made before starting to write any code for the implementation are some of the most important. Static analysis can be quite helpful, but depends a lot on the language making it work well.

Replying to

Static analysis doesn't work well for C, due to the lack of memory safety and very weak type system. It's very difficult to accurately analyze. It loses far more of the intent behind the design than a safer language and/or one with features for writing more structured code.

This Tweet was deleted by the Tweet author. Learn more

Replying to

I haven't made any statements that resemble "it seems plausible to me". You keep taking the approach of attacking me and misrepresenting what I've been saying. The statements I made about static analysis and self-explanatory. It works better when code has stronger guarantees.

9:56 PM · Apr 17, 2019Twitter Web Client

Replying to

In C, there are not many guarantees that *enforced* at compile-time. Static analysis works much better when it can build on lots of guarantees including about pointer aliasing. It can't work as well with something like references in Java vs. Rust where they are very constrained.

Replying to

Type systems themselves can be used to enforce many guarantees. That's a much more rigorous form of static analysis compared to heuristic-based checks. Rust's type system statically guarantees things like methods requiring an open file not ever being called on a closed file.

Show replies