Insights into how static analysis rules are structured, why false positives exist, how they're fought, and why - hard as we try - they may always be with us. 

False positives are our enemies, but may still be your friends

By Loic Joly

About the article:

When writing a rule for static analysis, it’s possible that in some cases, the rule does not give the results that were expected. Unfortunately, naming a false positive is often far easier than fixing it. In this post, I’ll discuss how the different types of rules give rise to different types of false positives, which ones are easier to fix than others, and how you can help. I’ll end with insight into how issues that are false positives can still be true indicators that the code needs to change.