How not to choke on a big old project
summary
Codebases grow by orders of magnitude so tiny mistakes hide for years; examples include a copy‑paste error that skips one axis check and a missing semicolon that makes a void function return an expression, both caught by static analysis. Use dynamic tools like run AddressSanitizer overnight to find actual memory bugs (no false positives but needs test coverage) and add static analyzers in CI or use SonarQube quality gates to flag new defects; suppress warnings on ancient modules to avoid 40,000+ legacy noise.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:25About me
- 2:53Some statistics
- 4:03Legacy
- 4:51What it looks like
- 7:52Proven methods
- 11:43Wait... what?
- 12:41Hunting of the Bug
- 14:03Where it leads
- 16:26True story
- 19:18What to do?
- 21:52On security
- 24:01DevOps + Security
- 25:16Dynamic analysis
- 26:36It's about movement
- 28:49Static analysis
- 30:03Code review done fast
- 32:11Static vs Dynamic
- 35:31SonarQube - why use it?
- 37:30First run
- 38:41Why and what to do
- 41:25Extreme
- 44:23GPL virus
- 45:35Let's summarise
related talks
22mWriting safe and secure code
43mEverything I learned about static analysis and program safety in C++
01h 31mClean(er) Code for Large Scale Legacy Applications
57mLessons from 20 years of Debugging C++ Code
09mModern Static Code Analysis the Example of PVS-Studio
57mThe Real Problem of C++
29mSecuring C code that seems to work just fine
01h 02mA Critical Look at the Coding Standards Landscape