Keynote: Code Analysis
summary
WhatsApp builds two production systems: Foster: privacy‑first spec‑based traffic generator that simulates client and server xmpp flows using biased random, Markov‑chain and evolutionary search plus guided flows, and Infer with Erlang frontend (p and t analyzers) for compositional static checks and taint properties. Both integrate into CI, Foster runs in ~25 minutes, finds ~1,800 unique reliability errors in one year with a 74% fix rate, and Infer reuses runtime traces to reduce false positives and scales across millions of lines.
AI-written summary · about
chapters (17)
- 0:00Code analysis at WhatsApp
- 1:08WhatsApp’s analysis tooling
- 3:18Microservice architecture challenges
- 7:19Static analysis for Erlang
- 9:52Open-sourced tools: Equalizer and Infer
- 10:33Client-side analysis for mobile
- 13:39Dynamic analysis with Foster
- 16:12Foster’s privacy-first traffic
- 24:54Evaluating Foster’s reliability
- 30:16Combining dynamic and static analysis
- 31:20Infer’s static analysis for Erlang
- 37:52Extending Infer for custom properties
- 38:35Hybrid analysis precision
- 40:00CI and DevX best practices
- 42:54Diff-time signaling and false positives
- 46:08Summary and open-source contributions
- 46:49Q&A
related talks
36mKeynote – James Governor
13mKeynote: Debugging in Prod Without (Lots Of) Pain
40mClosing Keynote: New Era of Software with modern Application Security
07mBest Practices and Key Takeaways
34mKeynote
01h 03mSwift Tools for Software Crafting 2024
52mAppSec at DevOps Speed and Portfolio Scale
48mUnbreakable by Design: The Secret Tech of Antifragile Software