[sdedovic]

Reminds me of something that happened a few years ago to me.

Company was primarily using Java for the backend. The Application Security team decided to start scanning all our deployable JARs and WARs with a static analysis tool. Well, immediately the tool started complaining about our libraries. For example, the official Elasticsearch library, for the version of the database we used, had multiple System.out.println calls. Well those were all flagged and the static analysis tool deemed our code unacceptable. We needed to use a logger, not stdout. So we had to go and take it up with AppSec. And explain, no thats not our code. Yes, it does run in production. No we can't use a different library.

The whole thing was exactly as you put it, a kafkaesque nightmare where I'm being punished for something I don't understand by people who don't understand. An no-one can tell me why.

[piokoch]

Phew, this at least spot some real issue (in some cases System.out.println can make multi-threaded program to get "synchronized" on console acces).

At some point I came across a tool (I think it was white source) that was going through Github page of each library used and was checking if there are no bugs reported.

Obviously very often there were totally bogus tickets, support requests created as bugs, rants as bugs, duplicates of already fixed tickets, etc. so investigating all that crap was really hard.

Another problem was licencing. There are a lot of libraries that have dual licence, e.g. GPL and CDDL, obviously the tool was panicking that GPL is used, not noticing that there is a second "business-friendly" license.

Those static analysis tools are not bad as a concept, however ratio of false positives to real issues found is too large to make them truly useful unless one can invest a lot of resources into tuning them.

[version_five]

Just want to point out that Kafka based his stories in part on his experience working in the (Hapsburg i think?) bureaucracy, in particular the idea of a faceless and impenetrable organization that can't be reasoned with an is full of catch-22s (which I haven't read). So I find it funny we call it Kafkaesque when Kafka was just referring to how bureaucracy is. We should call it bureaucratic and admit that is what all big orgs end up becoming.