Code review vs. static code audits
Yesterday I watched Mike Rozlog's presentation at Code PaLOUsa about Static Code Audits. I really enjoyed it. He gave a great motivational speech, advocating the use of static code audits, describing their benefits. I don't agree with Mr. Rozlog's attack at peer code reviews, though. He believes them to be inferior in efficacy to static code audits and he makes his point by bringing in statistics you can't fight. I, personally, think you should not compare these things at all. Yes, static code audits can find hidden bugs and code smells, they can check your code style etc. But, in my opinion, a peer code review is not about finding all bugs. It's about developer interaction, it's about exchange of knowledge. A static code audit can point out the bugs in your code but it cannot tell you how to make your code better (except for the most obvious things). It cannot teach you how to use your tools better. It doesn't teach you how to think and plan. It does...