Copyright © Coverity, Inc All Rights Reserved. This publication, in whole or in part, may not be reproduced, stored in a computerized, or other retrieval system or transmitted in any form, or by any means whatsoever without the prior written permission of Coverity, Inc. False Positives Over Time Andy Chou

Coverity Confidential: Do not distribute The Problem Bugs get fixedBugs get fixed False positives remainFalse positives remain Conclusion: Over time, FP rate approaches 100%Conclusion: Over time, FP rate approaches 100%

Coverity Confidential: Do not distribute Workarounds Never report false positives (“sound”)Never report false positives (“sound”) Mark FP’s in source codeMark FP’s in source code Fix assumptions/imprecisions with annotationsFix assumptions/imprecisions with annotations Stop using the toolStop using the tool RankingRanking doesn’t solve the problem doesn’t solve the problem Use historyUse history Mark bugs Mark bugs Remember they are the same Remember they are the same