We’re rewarding the question askers & reputations are being recalculated! Read more.
73

Code is just a means to an end. What that end might be varies, but typically it's profit. If it is profit; then to successfully argue anything you want to show that it will improve profit - e.g. by increasing sales, reducing maintenance costs, reducing development costs, reducing wages, reducing retraining costs, etc. If you can't/don't show that it will ...


53

Roslyn also appears to have the ability to "script" code and compile/execute it on the fly (similar to the CodeDom) but I have only come across limited uses for that type of functionality in my experience. On-the-fly compilation and execution is the key benefit of Roslyn. I think you may be undervaluing the benefit of this feature because you have never ...


44

Me, myself, and I, have been both a producer and maintainer of legacy code. If your tool's generating "thousands of violations" (or even hundreds for that matter), forget the tool, it's inapplicable to the situation... I assume the original developers are long gone and unavailable for discussion. So nobody's around who understands the why's and wherefore's ...


39

An interesting case study on the matters of scaling projects that use dynamic and interpreted language can be found in Beginning Scala by David Pollak. I started searching for a way to express the code in my brain in a simpler, more direct way. I found Ruby and Rails. I felt liberated. Ruby allowed me to express concepts in far fewer lines of code. Rails ...


36

What is Code analysis? Code analysis (previously FxCop) is a static analysis tool which searches for common patterns which may indicate that something is wrong in the source code. For example, if an instance of a class which implements IDisposable is not disposed properly, Code analysis will emit a warning: private void DoSomething() { var connection = ...


24

Your assertion is not wrong. You just need to dig little deeper. Simply said, big systems use multiple languages, not just one language. There might be parts that are built using "strict" languages, and there may be parts that are built using dynamic languages. As for your Google and YouTube example, I heard that they use Python primarily as "glue" ...


24

Static type systems are a kind of static analysis, but there are many static analyses that aren’t generally encoded in type systems. For example: Model checking is an analysis and verification technique for concurrent systems that allows you to prove that your program is well-behaved under all possible thread interleavings. Data flow analysis gathers ...


22

The reason that you would, ideally, want to only throw one type of exception is because doing otherwise likely violates the Single Responsibility and Dependency Inversion principles. Let's use an example to demonstrate. Let's say we have a method that fetches data from persistence, and that persistence is a set of files. Since we are dealing with files, we ...


16

In practice, however, nothing works quite as well as expected, and the project has been on DEFCON 1 for half a year. Now, most of my peers are happy if they can go back home at 6pm - on Sunday. This is certainly a good chunk of your problem. A software engineer cannot work productively for more than 40hours/week. If you go above that, you do serious ...


15

Style If you're talking purely about style, then it's an excellent idea. Style rules are objective and so are the results: if style rule tells that the team uses four spaces to indent the code, a line of code which is indented with two spaces is a mistake. Clear enough. Note that while style rules are objective (example: "The code is indented using four ...


13

I was wondering how they do that... How would you do it? I imagine that they are actually estimating the Big O measures ... by running the program for different problem sizes, measuring time and space usage, and fitting curves to the results. The problem with this approach is that it can get it wrong if the cost functions change shape as N gets large; e.g. ...


13

The question is not how good or bad that code is. The question is how much benefit you get from how much investment. So you have a tool that finds thousands of things that it doesn't like. You have the choice of ignoring the tool's results, or to invest work to change thousands of things. That's a lot of stuff. People will not be focused, not while making ...


12

I'm sure companies which provide tooling (e.g., JetBrains*) are very interested in Roslyn. Microsoft wants to make it easy to make tooling, because good tooling encourages the use of Microsoft's ecosystem. *Per the JetBrains blog (this entry), JetBrians has announced that they will not be using Roslyn. However, I imagine that any new competitors to ...


11

You are assuming a traditional build process, and Google's process is anything but traditional. There's a series of articles in the Engineering Tools blog that explain their process in some detail, elaborating on the 2010 presentation: Tools for Continuous Integration at Google Scale: Build in the Cloud: Accessing Source Code Build in the Cloud: How the ...


10

Can technical debt be detected by code analysis? This is like asking if a speedometer will make you a safer driver. However, I would normally think of technical debt as "A piece of code which doesn't follow the overall architectural pattern." Technical debt has many more faces than that. The metaphor is about borrowing time from your future self. Just ...


10

Sanitizers modify data to make it safe and/or usable by a program. For instance, escaping characters that may allow SQL injections, etc. Linters analyze code to search for stylistic issues, bugs, possible memory leaks... Static code analysis tools are any tool that analyzes source code without the need to run it. Linters are often static code analysis ...


9

I eagerly await the day when all compilers routinely offer Compiler as a Service (CaaS). We need to stop thinking that compilers emit only pre-linker code and start thinking that compilers emit trees which can be transformed into multiple targets. All compilers should have a feature to emit trees and optionally JSON/XML. The output can then be transformed ...


9

For example, some warnings could come from an internal representation gcc does not use, or from bytecode clang would intend to generate that gcc won't. Extremely unlikely. Clang is warning you about your code, not some internal representation that it uses. All warnings should derive from something suspicious you are doing in your code, not from any ...


8

It is definitely impossible to automatically check code quality, you can only check for some minimum code quality. Even "experienced" programmers are having trouble to formalize what actually constitutes code quality. And even among the "most skilled" ones, there's a high divergence in opinion on what is good or bad. There are some obvious rules that ...


8

In my experience, a determined, well-meaning, but clueless developer can wrap enough obfuscation around a concurrency bug that the analysis tool will miss it. If the tool thinks there's a bug, assume it's right until you prove otherwise. That's the value of the tool. If the tool doesn't find any bugs, your best bet is to pretend the tool doesn't exist. ...


7

One of the traditional definitions of software testing is execution of the program with the intent of finding bugs. This was Glen Myers definition, for example. We pretty much followed that definition in Testing Computer Software. I still see this--Wikipedia, for example, says "Test techniques include, but are not limited to, the process of executing a ...


7

Personally, I've never heard of the term "static testing". I have only heard of the term "static analysis", which refers to any time a work product is examined without being used. This includes code reviews as well as using tools such as lint, FindBugs, PMD, and FxCop. Here is some information from sources that I have available: Section 5 (Software Testing)...


7

The tools you list have nothing to do with code reviews. They are there exactly to let the reviewers to focus on more useful subjects. Code reviews are for important things which cannot be automated: using a design pattern when another one matches better, over-documenting clear code or under-documenting unclear one, not using language features which can ...


7

If it ain't broke don't fix it This practically ought to be tattooed on every software developer and manager so that they never forget it. Yes, it breaks all modern coding conventions. Yes, it's written in FORTRAN-77 with a wrapper in C so it can be invoked from Python. Yes, those are unstructured GOTOs. Yes, there's one subroutine three thousand lines ...


7

As others have pointed out, just counting clock cycles of assembler instructions will not give you a decent result for most modern CPU architectures. The execution time of a fixed piece of machine code can vary on different CPU platforms, even if the code is exactly the same. So the only reliable way of comparing the performance of such code snippets is get ...


6

For each of these tools you can select which classes of warnings you want to see, and which to suppress. I've got some experience with Klocwork, and the granularity of the selections there is pretty good, as well as the actual reporting, i.e.: you can filter out the "old" errors, and only see the incremental changes, when you run the tool on the changed ...


6

Findbugs examines the bytecode to identify patterns that tend to be buggy. This is far more efficient than analyzing source code. You would essentially have to parse the source anyway to analyze it, so let the existing compiler do that work for you and focus on finding bugs. By working with compiled bytecode, FindBugs can treat your code as identical to ...


6

What would be the alternative? No linter at all, and thus no style fixes at all - except for the ones found during code reviews. But obviously - the latter have to be applied manually as well. So this ultimately depends on how much value you see in those suggested style fixes the tool provides, and if you think applying those fixes (manually) is worth the ...


Only top voted, non community-wiki answers of a minimum length are eligible