[SystemSafety] OpenSSL Bug

[Patrick Graydon]

Leaving the religions of libre and gratis aside, does anyone know of any evidence that shows that adhering to MISRA-C specifically would improve the quality of FOSS*?  Les Hatton’s work has been critical of many of the rules in the standard [hatton2004saferlanguagesubsets,hatton2007language].  But the most direct work I know of on the value of MISRA-C in non-safety-critical software is a study that attempted to correlate the locations of defects in video playback software with MISRA-C rule violations found an overall *slightly negative* correlation (i.e. the rules were worse than useless) [boogerd2008assessing].  Is there any specific evidence that would outweigh this**?

— Patrick

*  There are  good reasons to adhere to a coding standard that have nothing to do with code quality.  For example, developers using a tool that is incompatible with a language construct must strictly avoid use of that construct.

**  Precluding certain coding constructs because someone finds them suspect and no-one has showed them beneficial might actually be harmful.  For example, developers changing code to fix a rule violation might actually introduce a critical defect.  Before we tell developers to *never* tolerate the use of a given construct (as opposed to avoid its use in new code where practicable) we should have evidence that the construct’s use brings dangers that are worse than the probably consequences of modifying code to eliminate it.


@article{hatton2007language,
	Author = {Hatton, Les},
	Journal = {Information and Software Technology},
	Pages = {475--482},
	Title = {Language subsetting in an industrial context: {A} comparison of {MISRA C 1998} and {MISRA C 2004}},
	Volume = {49},
	Year = {2007}}

@article{hatton2004saferlanguagesubsets,
	Author = {Hatton, Les},
	Journal = {Information and Software Technology},
	Number = {7},
	Pages = {465--472},
	Title = {Safer language subsets: an overview and a case history, {MISRA C}},
	Volume = {46},
	Year = {2004}}

@inproceedings{boogerd2008assessing,
	Author = {Boogerd, Cathal and Moonen, Leon},
	Booktitle = {Proceedings of the IEEE International Conference on Software Maintenance (ICSM)},
	Month = {October},
	Pages = {277--286},
	Title = {Assessing the value of coding standards: An empirical study},
	Year = {2008}}