Choosing the Right Static Code Analyzers Based on Hard Data

This talk explains how to assess static code analyzers based on practical criteria such as issue coverage, process integration, required inputs, speed, scalability, reporting, and result quality. It also introduces building an information source about software analyzers.

Syllabus

About the speaker
Outline of today's talk
What is this static analysis
What types of issues can static analysis find?
Using analyzers improves code quality & security
Build Kampar into a source of information about software analyzers, beginning with static tools
Basic information
Process integration
When & where will the analyzer run?
What inputs does the analyzer require?
Speed & scalability
Reporting
3. Coverage
Static analyzers have limited weakness coverage
5. Results quality
Challenges ahead
Make a contribution