Coverity: one bug fixed every six minutes [LWN.net]

Coverity: one bug fixed every six minutes

Posted Apr 5, 2006 7:30 UTC (Wed) by mingo (subscriber, #31122)
In reply to: Coverity: one bug fixed every six minutes by vondo
Parent article: Coverity: one bug fixed every six minutes

Actually, there is migration pain, because Coverity hinders GPL-ed debugging tools (such as Sparse) in several ways:

1) there's less incentive to develop them because Coverity fixes all the bugs

2) there's less incentive for upstream maintainers to accept debugging frameworks into the kernel codebase ('why this hassle, it doesnt detect many bugs' [but only because Coverity detected them already])

3) Coverity might be building up IP that it can use against free debugging tools later on.

there's a false perception of how 'healthy' the Linux development process is. Once Coverity goes away, things might deterioriate quickly, without any quick replacement. Bugs arent a one-time thing - they get introduced and fixed all the time. So the bugfixing methodology (and tools) need to be open-source just as much as all the other development tools need to be open-source.

Coverity already tried to attach proprietary strings to their bugreports: some sort of EAULA that forbids the use of these bugreports for the development of 'competitors'. That move definitly had a BitKeeper flavor. This requirement was removed for the Linux kernel bugreports, but how about other free projects?

to post comments

Coverity: one bug fixed every six minutes

Posted Apr 6, 2006 11:24 UTC (Thu) by lacostej (guest, #2760) [Link] (1 responses)

If such an open source tool existed, it could still be ran against the old version of the software to find errors in (before they got fixed).
That would be a good way to check its efficiency.

Coverity: one bug fixed every six minutes

Posted Apr 6, 2006 11:57 UTC (Thu) by mingo (subscriber, #31122) [Link]

Nothing beats the experience of finding bugs in the latest and greatest. Just like Coverity needs (and uses) the resulting PR (both small-scale and large-scale PR) of finding bugs, an open-source source-code-validator project needs similar feedback. Much fewer people will use and rely on an OSS tool that can only find old bugs.