Coverity Scan VS Splint

Coverity Scan Reviews

Splint Reviews

Coverity Scan mentions (4)

• I created this point of sale system for restaurants and hospitality. The All-In-One has a 15.6" touchscreen running a Raspberry Pi Compute Module 4L and is made by Chipsee in Bejing, China. I'm helping a friend install it in a restaurant on the St. Lawrence River where he is the Executive Chef.

  You can use Coverity for free on open source code. I use it on an app I open sourced for packet processing. https://scan.coverity.com/. Source: over 2 years ago

• Free for dev - list of software (SaaS, PaaS, IaaS, etc.)

  Scan.coverity.com — Static code analysis for Java, C/C++, C# and JavaScript, free for Open Source. - Source: dev.to / almost 3 years ago

• CDN dollar just hit 6 year high.

  I personally remember Coverity Scan being completely offline for like 6 months while they tried to deal with infrastructure abuse from people mining bitcoin on their computing clusters. Source: almost 3 years ago

• GCC 10.3 has been released

  > Does anyone know any good static analysers other than gcc's or clang's? Visual C++ as well, because since the XP SP2 issues, Microsoft has come up with SAL, which you can also use on your own code, https://docs.microsoft.com/en-us/cpp/code-quality/using-sal-annotations-to-reduce-c-cpp-code-defects?view=msvc-160 Then specialized tooling just for this purpose, just two examples, https://scan.coverity.com/... - Source: Hacker News / about 3 years ago

Splint mentions (9)

• C-rusted: The Advantages of Rust, in C, without the Disadvantages

  Whenever I see people talk about the portability or compatibility advantages of C, I'm reminded of how "even C isn't compatible with C", because you typically aren't talking about up-to-date GCC or LLVM on these niche platforms... you're talking about some weird or archaic vendor-provided compiler... Possibly with syntax extensions that static analyzers like splint will choke on. (Splint can't even understand near... Source: about 1 year ago

• Announcing Rust 1.67.1

  Huh. I think I actually needed to use the equivalent position for certain splint annotations in my C retro-hobby project. Source: about 1 year ago

• US NGO Consumer Reports also reporting on C and C++ safety for product development.

  I often like to say that Rust's bindings are a way to trick people into writing the compile-time safety annotations that they didn't want to write for things like splint. (Seriously. Look into how much splint is capable of checking with the correct annotations.). Source: over 1 year ago

• “Rust is safe” is not some kind of absolute guarantee of code safety

  Linters like Splint [0] can do that for C. I’m not saying that Rust’s built-in approach isn’t better, but please be careful about what exactly you claim. [0] http://splint.org/. - Source: Hacker News / over 1 year ago

• Glauber's Journey from rust to typescript

  (Sort of like how, for my DOS hobby project, I use splint to require explicit casts between typedefs so I can use the newtype pattern without having to manually reach into wrapper struct fields in places that don't do conversions.). Source: almost 2 years ago