Post B9jwfT50II63udiMmu by mntmn@mastodon.social
 (DIR) More posts by mntmn@mastodon.social
 (DIR) Post #B9jwfT50II63udiMmu by mntmn@mastodon.social
       0 likes, 0 repeats
       
       because i have to deal with rk3588 kernel bugs i was looking through new lkml commits with automated review comments by "sashiko" and i was interested in how this works... this seems really sketchy? idk are there really no proper static analysis tools for C? https://github.com/masoncl/review-prompts/blob/main/kernel/false-positive-guide.md#5-use-after-free-confusion
       
 (DIR) Post #B9jwuxnsLWPBXo5l0i by mntmn@mastodon.social
       0 likes, 0 repeats
       
       @Mae it really feels very bogus to me
       
 (DIR) Post #B9jyICwoJ4o57xv1BA by mntmn@mastodon.social
       0 likes, 0 repeats
       
       @moses_izumi @zzt the name is explained here in the about box when you click on the logo https://sashiko.dev/
       
 (DIR) Post #B9jyqDHFaTh3znh6hc by lhp@mastodon.social
       0 likes, 0 repeats
       
       @mntmn there is gcc's new -fanalyzer which I like a lot, but it's also sloooow (over 6min for a 12k lines C file) and from what I can tell seems to ignore function attributs (unlike ASan and UBSan). Also it still has false positives around realloc() which is annoying
       
 (DIR) Post #B9jyzRIQpmVk56e7xQ by swetland@chaos.social
       0 likes, 0 repeats
       
       @mntmn We live in the dumbest timeline where we're replacing all existing, reliable, repeatable tools with AI Slop Machinery no matter how much shittier it is.
       
 (DIR) Post #B9k2rChvagQcKptsye by sherbang@chaos.social
       0 likes, 0 repeats
       
       @mntmn unbelievable. Magical thinking.
       
 (DIR) Post #B9k8uB1EvNQlgxjZi4 by ch2500@chaos.social
       0 likes, 0 repeats
       
       @mntmn haven't looked at the llm stuff, but f.e. Coverity Scan is ... not great
       
 (DIR) Post #B9kDiFYWjKYA3hR6GG by jacqueline@chaos.social
       0 likes, 0 repeats
       
       @mntmn i love my serious professional tool that is totally the future of software development. just remember to write "(MANDATORY)" next to the instructions or sometimes it won't work properly
       
 (DIR) Post #B9kFcDwW0xabE6uX5c by mntmn@mastodon.social
       0 likes, 0 repeats
       
       @jacqueline > CRITICAL: When dismissing an issue because a comment or documentation says the code behaves a certain way, you MUST verify against the actual implementation
       
 (DIR) Post #B9kFh3ZA1RA8UYI7Ky by jacqueline@chaos.social
       0 likes, 0 repeats
       
       @mntmn i've been making this simple mistake for YEARS !
       
 (DIR) Post #B9kGKnpJxa9fGCnocC by mntmn@mastodon.social
       0 likes, 0 repeats
       
       @jacqueline there are also typos in there that might change the meaning, for example "If you cannot prove an issue exists with concrete evidence in at least on execution path, do not report it"... i guess it's supposed to be "one" execution path... lets hope sashiko understands that :3
       
 (DIR) Post #B9kGwozm400LtAowds by mntmn@mastodon.social
       0 likes, 0 repeats
       
       @jacqueline kind of a cringe hill to die on also...
       
 (DIR) Post #B9kHdwpcnujKe2db4C by gsuberland@chaos.social
       0 likes, 0 repeats
       
       @mntmn surely CodeQL is perfect for this?
       
 (DIR) Post #B9kHxi0He086Rq2uFk by gsuberland@chaos.social
       0 likes, 0 repeats
       
       @mntmn @jacqueline this sort of instruction also tends towards "if you did not prove an issue exists do not report it", and then just not proving issues because it leads to an easy concrete conclusion.get-out clauses like this almost always lead to behaviour equivalent to reward gaming in classical ML.
       
 (DIR) Post #B9kIHhR3SyjiTf6HUu by mntmn@mastodon.social
       0 likes, 0 repeats
       
       @gsuberland huh, that looks interesting, hadn't come across it!
       
 (DIR) Post #B9kJDxEsrnBiHtBYzw by gsuberland@chaos.social
       0 likes, 0 repeats
       
       @mntmn oh it's awesome. it hooks into the compiler and builds a complete code flow and data flow graph database. it's the only SAST I am aware of that can see through language features like C++ template deduction.