Conversation

This Tweet was deleted by the Tweet author. Learn more

Replying to

I respect Daniel (not _just_ because we have first names in common :P), but I've heard that argument made elsewhere and I got the understand that it was on the basis of Coverty not being worth setting up - not necessarily that it's worth tearing down if it's already working?

This Tweet was deleted by the Tweet author. Learn more

Replying to

FreeBSD does care about code quality, though - everything from style upwards gets brought up regularily.

This Tweet was deleted by the Tweet author. Learn more

Replying to

As far as I know we ran Coverity on Gecko way back in the day and it didn’t really do anything to address the flood of security problems.

Replying to

I think a distinction needs to be made between claims. I agree it's implausible that static analysis can find/fix any significant portion of flaws in C code with fundamentally bad object lifetime and ownership policy. OTOH...

This Tweet was deleted by the Tweet author. Learn more

Replying to

I already wrote a thread explaining what I mean, which you know: twitter.com/DanielMicay/st Deliberating going out of the way to misrepresent my statements and then pretending I didn't clearly explain my thoughts on this is dishonest.

Quote Tweet

Daniel Micay

@DanielMicay

Apr 17, 2019

Replying to @vyodaiken @billhuey and 5 others

I haven't made any statements that resemble "it seems plausible to me". You keep taking the approach of attacking me and misrepresenting what I've been saying. The statements I made about static analysis and self-explanatory. It works better when code has stronger guarantees.

Replying to

Quote Tweet

Replying to @DanielMicay @vyodaiken and 6 others

In C, there are not many guarantees that *enforced* at compile-time. Static analysis works much better when it can build on lots of guarantees including about pointer aliasing. It can't work as well with something like references in Java vs. Rust where they are very constrained.

Replying to

Quote Tweet

Replying to @DanielMicay @vyodaiken and 6 others

Type systems themselves can be used to enforce many guarantees. That's a much more rigorous form of static analysis compared to heuristic-based checks. Rust's type system statically guarantees things like methods requiring an open file not ever being called on a closed file.

5:16 PM · Apr 18, 2019Twitter Web Client

Replying to

Quote Tweet

Replying to @DanielMicay @vyodaiken and 6 others

An external static analyzer has to build on top of the type system. When it looks at code doing something like writing to a reference, knowing that the reference is guaranteed to point to only something with that type is a big deal, as are further memory dependency guarantees.

Replying to

Quote Tweet

Replying to @DanielMicay @vyodaiken and 6 others

So, for example, in Rust, a write through a mutable reference *cannot* do anything that would be seen through any of the current immutable references. The static analyzer knows that the write to &mut T does not impact what &T references can see and so on. That's how they work.

Show replies