Hacker News Reader

Comment by joshstrange | Hacker News Reader

> Coverity Scan is a free static code analysis tool for Java, C, C++, C# and JavaScript. It analyzes every line of code and potential execution path and produces a list of potential code defects.

There we go, I had no clue what this even was. Do a lot of people here use it?

View on HN

Coverity have one of the best static analyzers for C++ and CSharp. Not a surprise considering they have had* ex-Microsoft compiler engineers such as Eric Lippert working for them.

I understand from speaking to C++ engineers who have extensive experience in embedded / industrial applications that Coverity is used extensively there.

Personally I've never seen the need to apply it to CSharp projects because the language is naturally safer than C++ and you get a lot of "bang for the buck" by using the tools built into Visual Studio and from JetBrains.

* He works at Facebook now :facepalm:

We pay for Coverity for our closed source products and are quite happy with it. But you have to have a project committed to staying on top of static analysis to really get the value out of it. Our product domain means we do, and for all our static analysis tools we have a fix-or-document rule where we have to address every warning before a release. Coverity is great for us.

Coverity was the first really good static analysis tool -- a classic example of serious academic research (the "Stanford Checker") being spun off as a commercial product.

Unfortunately they lost their focus and got acquired; if they had taken a different course they could be an essential security tool.

"A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World" (2010) is a classic popular level account of Coverity. It is very funny, in an unintentional way. Highly recommended reading.

https://cacm.acm.org/magazines/2010/2/69354-a-few-billion-li...

I've used it for the OSS project I'm working on (https://ossia.io) but at some point the coverity scans just started failing, and they never replied to my support requests.

I have access for two opensource programs using it (bitchx and znc). The webui is a bit like a full blown IDE. It has found a few bugs (some are CVE's) in various projects.

https://github.com/znc/znc/search?p=1&q=Coverity&type=Commit...

https://github.com/bitchx/bitchx/search?p=1&q=Coverity&type=...

Reply on news.ycombinator.com