On: Heartbleed and Static Analysis

[Ono-Sendai]

I think this is a good demonstration of the limitations of static analysis - for a language like C, there will always be bugs that can't be found statically.

[Peaker → Ono-Sendai]

Unless you're willing to move the burden to the programmer, to prove correctness.

Bugs can always be found statically, but there may always be bugs that evade all the static analysis you happened to do.