Choosing The Right Static Code Analyzers Based On Hard Data
summary
An independent benchmarking project produces a public catalog of static analyzers and a small web product at compare.tools that currently lists 73 tools. The team runs open‑source analyzers themselves against standardized sets such as the Juliet test suite, reports run times using stock configurations, and highlights a startling published figure that any single analyzer finds about 14% of weakness instances. Proprietary result details remain restricted by vendor licenses.
AI-written summary · about
chapters (17)
- 0:00About the speaker
- 0:57Outline of today's talk
- 1:34What is this static analysis
- 2:49What types of issues can static analysis find?
- 3:32Using analyzers improves code quality & security
- 5:54Build Kampar into a source of information about software analyzers, beginning with static tools
- 8:04Basic information
- 8:57Process integration
- 10:38When & where will the analyzer run?
- 12:13What inputs does the analyzer require?
- 13:25Speed & scalability
- 14:59Reporting
- 18:143. Coverage
- 19:39Static analyzers have limited weakness coverage
- 20:295. Results quality
- 26:44Challenges ahead
- 29:24Make a contribution
related talks
29m“The Current State of (free) Static Analysis"
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
51mReal World Static Analysis For Real Humans
45mAnalyze This
47mHow Code Analyzers Find Bugs and Security Defects
44mUsing Static Analysis Tools to Become A Superhero Programmer
05mWhy Can't Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools
39mPractical Static Analysis for Continuous Application Security