Findings by static analyzers in the `dev` branch

[siteshwar]

This is a follow up on #850.

I perfomed a static analysis scan of the dev branch through OpenScanHub and used Opus 4.6 (1M context) to analyze the report. Attached analysis contains a total of 8 Low impact, 45 harmless and 46 false positives findings. Each analysis contains a proposed fix.

I have manually reviewed the reports and based on my analysis the low impact findings should be fixed. We are in the early stages of using AI to analyze static analysis reports, so sometimes there is an inconsistency between rating issues. The false positives and harmless findings may be used to harden the code.

ksh-ddf87f04-ai-analysis.tar.gz

[McDutchie]

Thanks for the PR, @siteshwar. I'm working my way through all the reports. It takes a lot of time and effort, because the AI is highly verbose, and its analysis is not always correct. For example, at least one of the “false positives”, 2.txt, represents a real problem (a fatally broken C probe in conf.tab that doesn't even compile).

I appreciate an opportunity to fix all these problems. What I appreciate less is the workload put on me as a result of the AI analyses, which cannot be trusted at face value and must be carefully verified. I fear that AI will become a way to reduce the workload on submitters of PRs, while greatly increasing the workload on maintainers.

[avih]

I fear that AI will become a way to reduce the workload on submitters of PRs, while greatly increasing the workload on maintainers.

It already happens everywhere.

Many projects have a policy that there must be a human involved, which submits whatever as their own, is responsible for the content, and knows it as if they wrote it.

Unfortunately these policies are many times not followed, to say the least, which means that users can trivially report massive amounts of issues or patches with a keypress, leaving maintainers unable to keep up.

Sometimes such submissions have some values. Many times they don't. Unfortunatey the burden of figuring out which is which falls on maintainers....

If the human behind the submission can't vouch for the content and submit it as their own, then IMO there's no value in it - and many projects outright reject such submissions. The maintainers can produce similar reports on their own (using whatever tools) without an intermediary user.