DevCon:Powers of PreFAST

Well, the last session was over that I wanted to attend, so I thought I would go say bye to Neil and the gang. Had a great conversation, which got onto the topic on if I learned everything I wanted to. I expressed that I did, hold that to this tool called "prefast" that everyone was talking about.

Well, to my suprise I was taken to a terminal and given a one on one training session on using the tool by Neil! Now THAT was nice. But even nicer, was seeing this AWESOME tool. If you don't know, PreFast is a static analysis tool that can find defects in your code during compile time, and has some great security tests built right in. It slows down the compile considerably, but is worth its weight in gold. Prefast finds errors such as memory leaks, corruption of memory, and null pointer references.. and has a nice UI to view the results, view your code... and more important tell you WHY its wrong and suggest how to fix it. With any luck, the application development teams will learn from this and make a similar tool for .NET.

I am going to mandate that any code being checking in MUST first go through and pass Prefast, returning with zero errors and warnings. For false postives (which can easily occur since this can't do really deep analysis), pragmas will need to be used WITH COMMENTS to explain why a line of code will be supressed.

This will be a useful addition to our master build, and should challenge the quality of our codebase at all times.