A report on a survey and study of static analysis users

Authors:
Nathaniel Ayewah;William Pugh
Affiliations:
Univ. of Maryland, College Park, MD;Univ. of Maryland, College Park, MD
Venue:
DEFECTS '08 Proceedings of the 2008 workshop on Defects in large software systems
Year:
2008

Citing 9
Cited 9

Beyond the Personal Software Process: metrics collection and analysis for the differently disciplined

Proceedings of the 25th International Conference on Software Engineering
Evaluating and tuning a static analysis to find null pointer bugs

PASTE '05 Proceedings of the 6th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering
Tracking defect warnings across versions

Proceedings of the 2006 international workshop on Mining software repositories
Evaluating static analysis defect warnings on production software

PASTE '07 Proceedings of the 7th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering
Finding more null pointer bugs, but not too many

PASTE '07 Proceedings of the 7th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering
Understanding the value of program analysis tools

Companion to the 22nd ACM SIGPLAN conference on Object-oriented programming systems and applications companion
Toward Reducing Fault Fix Time: Understanding Developer Behavior for the Design of Automated Fault Detection Tools

ESEM '07 Proceedings of the First International Symposium on Empirical Software Engineering and Measurement
Predicting accurate and actionable static analysis warnings: an experimental approach

Proceedings of the 30th international conference on Software engineering
Using Static Analysis to Find Bugs

IEEE Software

Security from the bottom-up: compliance regulations and the trend toward design-oriented web applications

Journal of Computing Sciences in Colleges
Using checklists to review static analysis warnings

Proceedings of the 2nd International Workshop on Defects in Large Software Systems: Held in conjunction with the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2009)
Making defect-finding tools work for you

Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering - Volume 2
The Google FindBugs fixit

Proceedings of the 19th international symposium on Software testing and analysis
A study on improving static analysis tools: why are we not using them?

Proceedings of the 34th International Conference on Software Engineering
A novel approach for discovering barriers in using automatic static analysis

Proceedings of the 17th International Conference on Evaluation and Assessment in Software Engineering
Does bug prediction support human developers? findings from a google case study

Proceedings of the 2013 International Conference on Software Engineering
Why don't software developers use static analysis tools to find bugs?

Proceedings of the 2013 International Conference on Software Engineering
Novice understanding of program analysis tool notifications

Proceedings of the 2013 International Conference on Software Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

As static analysis tools mature and attract more users, vendors and researchers have an increased interest in understanding how users interact with them, and how they impact the software development process. The FindBugs project has conducted a number of studies including online surveys, interviews and a preliminary controlled user study to better understand the practices, experiences and needs of its users. Through these studies we have learned that many users are interested in even low priority warnings, and some organizations are building custom solutions to more seamlessly and automatically integrate FindBugs into their software processes. We've also observed that developers can make decisions about the accuracy and severity of warnings fairly quickly and independent reviewers will generally reach the same conclusions about warnings.