Hacker News new | past | comments | ask | show | jobs | submit login
We continue checking Microsoft open source projects: analysis of PowerShell (viva64.com)
83 points by AndreyKarpov on Nov 2, 2016 | hide | past | favorite | 35 comments



So far I'm impressed by every demonstration of PVS Studio that gets linked here and I love the developer's way of using open source projects for demonstrations (and thereby improving these projects). Great job.

Unfortunately the software seems to have no single developer license (only 'Team' and 'Site') and you have to write them a mail to even get a quote [1]?

In other words: Awesome tool, completely unavailable and out of reach for me.

Are there any somewhat comparable tools in the C# world that you use in your projects, apart from StyleCop/FxCop?

1: http://www.viva64.com/en/order/ - "Please write us from your corporate e-mail address for details on PVS-Studio prices. Specify information about your company and the type of license you would like to purchase (see the table below)."


SonarQube and Resharper have some similar coverage. I'd recommend both (at the same time or individually).


SonarQube is incredible (and free). We've been using it at work, and it's uncovered bugs in a codebase that's been around for years.


For information, I wanted to point out that PVS-Studio is able to integrate with SonarQube: http://www.viva64.com/en/m/0037/


I see just now on their http://cpphints.com/ site they've posted a download link for the Linux version: http://www.viva64.com/en/pvs-studio-download-linux/

And a Windows version is also available (link at the bottom). Haven't tried it yet and also I don't see the terms spelled out on first glance.


I've heard a lot about NDepend in the dotnet world. Mostly because Erik Dietrich blogs about it constantly.


Please write us at support@viva64.com, I think we can provide a free license personally for you :-).


While that is a nice gesture towards darklajid, this ofcourse doesn't help other people. See also other replies in this thread. Maybe your company should consider opening up the pricing some more. Offer plans without having to send an email, offer a personal plan, etc.


Hey, so according to the latest post on cpphints.com you "invite everybody to try it on the code" and there is a link to http://www.viva64.com/en/pvs-studio-download-linux/ . Also I read on your page that "PVS-Studio distribution kit can be downloaded on the download page. The demo version has restriction of the number of the click-jumps to the code fragments that contain bugs.".

I tried to play with it but got to "Please request a trial license from our support at support@viva64.com.".

So, is there a free trial or not? Should I expect to get a free trial if I contact that address? (I have no intent to buy anything really)


From "PVS-Studio for Linux" - http://www.viva64.com/en/b/0441/

The new Linux version (.deb, .rpm, .tgz) is available for download on the page:

http://www.viva64.com/en/pvs-studio-download-linux/

We also recommend reading the documentation section "How to run PVS-Studio on Linux" http://www.viva64.com/en/pvs-studio-download-linux/ . If something is not clear or something does not work, we will gladly help you, feel free to ask questions in the mail.

If you want to get a registration key to try out the tool - contact us http://www.viva64.com/en/about-feedback/ . Over the time the process of getting the trial version may change, but now it is important for us to understand who downloads the analyzer, how the person uses it and which issues appear during the usage.


What was that loud noise!

Ah yes, it was the floodgates opening... ;@)


It may be the greatest thing in the world but when you click through to the price/buy page you get the ever craptastic line: "Please write us from your corporate e-mail address for details on PVS-Studio prices." In other words, too expensive for consideration outside the fortune 500.

No, I don't want to negotiate a price, discuss my use case, or provide any information as to how I would be using the product in order to get a price. Can you imagine buying a house, a car, a most anything else like this?! "So, are you planning to eat that gallon of ice cream yourself or are you going to give it to kids at a birthday party? A party ... maybe we can work out a deal."


"How much?"

"How much you got?"


You haven't actually explained why you think a negotiable price for PVS Studio is a bad thing. Your hyperbolic scenario of the ice cream is just that, hyperbolic.


Isn't it enough that it makes it more difficult than necessary to compare the various offerings in the field (PVS-Studio, Coverity, Klocwork, etc.)?

Is there seriously sufficient competitive advantage to stopping casual consideration of the value proposition? Because the competitors can more than likely pry a quote out of a sales representative.


Well it allows them the set prices on per-lead basis. I suppose it is a form of price discrimination. A lot of companies do it in the open and it seems to work for them - Uber/Amazon/Expedia/Sears/etc. A lot of cloud companies are doing it as well where they charge exorbitant prices for "enterprise" grade service.


When the stated price of something is "negotiable", it means you don't have the ability to even do a quick calculation of if it's worth considering. The lack of information is galling.


Yeah, but I'm not talking about 'something'. I agree that it would be a giant pain in the butt for a toothbrush. But for a code analyzer you'd have to atleast run a trial/demo on your codebase to see if its actually valuable in your particular situation. Anyway, for me, picking up the phone and talking to someone for 5 mins doesn't seem that scandalous. I'm in an industry where I have to do it often so maybe I'm just used to it.


If I have to pick up a phone to call a person and hand over personal contact information before I can even consider evaluating if your product is useful to me... then odds are very good I will never, ever evaluate your product. I am not a fan of phone calls and I resent being coerced into one for the sake of some silly marketing metric.

If your software is so hard to use that you can't post a basic demo somewhere, I probably don't want to use it anyway.


I guess we have differing opinions. For me, that phone call gives me more information than what I give them. I can grill the technical sales on specific questions based on what they say about their product. If they let me chat with the devs, I'll be even more impressed. The way I see it.. If you're at the level of trust where you'd consider running a "random" executable on your machine and give it access to your source code, then what difference does it make if they have your email?


I am not in the habit of assuming technical sales personnel will have useful things to say. Having been in some companies in the past with technical sales people, I wouldn't want to inflict a sales prospect on a dev who has other things to do.

I have greater faith in my ability to deal with a random executable somewhat safely than I do my patience for a salesweasel who might know what source code is.

So, yes, we have differing opinions. I don't see why I should have to hand over any non-essential data and deal with a human to try a purely software product.


A negotiable pricing structure hides the true value of the product behind needless bureaucracy and interaction. Not having a sticker price (even a "no one actually pays this much" sticker price, like MSFT's) makes fair comparisons impossible without getting into a high-touch sales cycle.

For them, it's almost surely meant lost sales.

In my org, I'm the one who would be making the decision to trial products like this. For me, it's meant that they haven't gotten a serious look-in. We don't have particular code quality issues so I'm not shopping around between static analysis tools, but I am always open to improving our processes. The bar that they need to reach in order for me to spend time seriously evaluating their product is much higher. If the software was eg 10k/yr it's a very different matter to it being 100k.

I'm curious about the product and the benefits that it brings over our existing static analysis setup (SonarQube + Resharper + Microsoft Code Analysis), and if I had any idea what I'd be getting into I'd probably have set up an instance somewhere, but that's time that I'm not prepared to spend without at least some idea of whether it could even result in us making a buy.

Neither my time, nor that of anyone else in my org is free. I'm not going to evaluate a product, make a decision and then ask how much to see if the vendor has reasonable prices. Even used car lots list prices on their cars so you can judge a "worst case" cost and filter out the absolutely ridiculous ones.


So you say you are serious and open to improving your process, but you would refuse to look at a product because 10 minutes (or insert nominal time sending an email) is more time than you're willing to spend to obtain a demo/quote. Well, its your choice, but frankly I don't quite see the logic behind it. Personally I think the 10 minutes (and I have spent more on similar products) is time well spent if the potential upside is gaining several days time spent finding and fixing bugs. Even if it finds one bug, you'd probably recover the 10 minutes as far as lost time goes.

Edit: This applies in this specific context, where the market is not exactly deluged with code analyzers.


If the business was burning down because of code quality issues, I'd definitely navigate through whatever process the vendor throws my way to get access to their software. Same if I woke up one day and decided "we need to throw away our static analysis and find a replacement". Same if the email exchange was only 10 minutes with 1 email going each way (ha!)

But none of those are the case, we have no serious problems with our existing process, nor any real incentive to actually try out alternative static analysis setups. What drives us to find something better is curiosity. Every month or two, I'll see something related to our process (not specifically code quality), look into it along with another alternative or two, and try to figure out quickly if it's worth dedicating time to look at it in depth. I'm making that initial decision based on 10 minutes of skimming the vendor's website. I don't want to sink a week of peoples' time into actually properly setting something up to find out that our org will be charged higher fees than we expect (in much the same way that I don't want to drag a bunch of people into a meeting room for a couple of hours for a product demo until we've independently verified that the product can actually work for us; or set something up and have it bite us a couple of years down the road when it's become entrenched in our processes).

Realistically, I have a fair idea of how much the software will likely cost. From what I've seen (assuming I'm correct), the price (low 5 figures) wouldn't be a dealbreaker (though it would definitely have to bring some advantages when compared to what we've got now in order to sell it to management). But, after a number of our negative b2b experiences w/ opaque pricing (eg price scheme changes at the end of the contract term, or being billed higher than others because we were [at that time] reliant on the product) we know that there's a cost involved in this. It's something that is worth some dollar amount for us to avoid.

I want a binding quote that I know is going to scale linearly with our organisation; a dollar figure that's not going to change sharply in 3,4,5 years; no significant meddling by salespeople -- all in addition to a solid product. Published and available-to-anyone prices help ensure that.

I just want to note that I'm not against OOO in any way, or even saying anything bad about their software, but opaque pricing on products just doesn't make sense for us (much in the same way as products-as-subscription don't make sense for us, even though we normally keep up to date with upgrades/support).


Okay fair enough. Thanks for explaining your position.


>You haven't actually explained why you think a negotiable price for PVS Studio is a bad thing.

You're right.

It's a bad thing because I want to spend exactly as close to zero seconds looking at a product or service that's going to immediately be ruled out because the price is too high for my budget. If I can see the price I can avoid all the communications and discussions and move on.

Also, when price is constantly negotiable I stand the risk of becoming dependent on a product only to find the company raising on me (and not across the board) based on their belief that I can be squeezed because I am dependent. Look no further than Oracle for this type of behavior.

(I liked my hyperbolic scenario because it was short and involved both kids and ice cream. Who dares to challenge kids and ice cream? ;-)


Well, it depends on many factors. Firstly, IMHO, the comparison with Oracle doesn't quite fit. A code analyzer is not a design/infrastructure dependency like a database. You can stop using the code analyzer and your software will continue to build.

Anyway, to give you an anecdote.. My current work is in a niche industry where "simple" software is often very expensive and prices are never displayed ( $10,000 per seat). What I've found is that often times, the company itself would let me know that their software is not a great fit for our company because I contacted them and explained the use case. Other times, not displaying the price allows them to give a price cut to smaller startups and "tax" larger companies for whom the price is negligible.


You're anecdote is my point exactly?!

If your current employer would list the $10,000 per seat price (or even a range -- $8,000 - %12,000 per seat depending on reasons) then someone was willing to consider an order of magnitude less could immediately skip your employer's product. Instead, it's their desire to have potential customers open a dialog so you can explaining value proposition and get them more invested. We can get to know each other as people and touch bases again next year ...

That crap is exactly the problem, not the solution. I don't want to take the time to be polite if I know your price is an order of magnitude out.


Because a hidden price almost always means "too fucking expensive".


Could you find a pricing info on Coverty, Klocwork, Parasoft, etc sites?


Very interesting read, as I didn't know about the tool. I spent quite a lot of time reading other analysis results; and realised that some mistakes were more frequent than I thought they were.

I also really like the idea of analysing open source projects to demonstrate the product.

It is however completely unavailable to me: do you guys have any plans to support other operating systems and compilers in the future (hint: Linux)? What would it take to do so? That's also one of the cases where I wish the software itself was open source, though I can understand your reasons.


PVS-Studio for Linux!!! http://www.viva64.com/en/b/0441/


Oh, thanks, that's some great news. I was reading through the (by definition, outdated) blog posts, and it was mentioned quite frequently that it was a visual studio only tool.

Now I need to look more into the opportunities for continuous integration with PVS-Studio in OSS projects. Maybe the Linux kernel itself, if that hasn't already been done already!



I love these articles. Great stuff.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: