Main

И16: Рыжков Е.А. | PVS-Studio, Static Code Analyzer, AI Analyzer, Legacy Code, Open Source [eng sub]

Евгений Александрович Рыжков - сооснователь PVS-Studio, инструмента для обнаружения ошибок и уязвимостей безопасности в исходном коде программ, написанных на C, C++, C# и Java. PVS-Studio: - https://pvs-studio.com/en - https://pvs-studio.ru GitHub: https://github.com/viva64 Plugin for Visual Studio: https://marketplace.visualstudio.com/items?itemName=EvgeniyRyzhkov.PVS-Studio YouTube PVS-Studio En: @PVSStudio_channel YouTube PVS-Studio Ru: @PVSStudioTool Habr: https://habr.com/ru/users/evgeniyryzhkov 0:00 Чем занимается PVS-Studio 3:07 Должен ли CTO писать код 6:12 Где берут специалистов по статистическому анализу 10:35 Как внутри компании оценивают программистов 15:46 Ситуация с кадрами на рынке IT 19:55 Конкуренция с международными компаниями 24:50 Кто в компании придумывает методы поиска ошибок 27:31 Станут ли все решения open-source 31:27 Конкуренция с ИИ 34:05 Что сейчас интересно программистам 38:44 Текущее качество кода в индустрии 42:35 Сколько стоит решение 47:12 В какие сферы сейчас вкладываться 51:49 Взаимодействие с университетами и учеными 56:27 Конкуренция в IT 58:10 Как сильно геополитика повлияла на бизнес

Yegor Bugayenko

2 weeks ago

Evgeniy, thank you very much for coming to talk to us. We know, I at least know what you do, but it would be interesting for our listeners to tell you in a nutshell about PVS-Studio and when it started, and why you became interested in developing this kind of software product . PVS-Studio is a static code analyzer, a tool that helps programmers find errors in code. We have been working on this topic for quite some time. Last year the PVS company was 15 years old, and all these years we have been
developing code analysis technologies, helping programmers use analyzers in their projects, and telling about it through articles and conferences. Thus, telling people basically about this technology, about how you can benefit from static analyzers, and how to apply it in a way that is useful and noticeable. How did you come to this? Were you a programmer yourself, you personally? Or were you more of an entrepreneur who wanted to make money from this technology? I am now the co-founder and CEO
of the company. In theory, it appeared when I, together with my partner Andrey Karpov , as a programmer, were working on migration to 64-bit applications. This was in 2006. Then 64-bit processors appeared, desktop AMD 64, and migrating code to these 64-bit processors was accompanied by unexpected problems that were difficult to find with existing tools. And the idea came up to make a tool that would help port code to 64-bit. I note that now there is almost nothing left of this idea. The 64-bit t
opic has long been out of date, and the errors associated with it are just as out of date, but that’s how the idea started. We developed it together, but now this is a much more serious product than two people could ever imagine. Currently our team employs 50 people. Are you still programming? You personally? No. Now my main area of ​​interest is management, organizing the work of teams, helping in the interaction of teams. And I moved away from programming quite a long time ago, although I stil
l tell grandmothers on the street that I am a pretty convincing programmer. Do you regret leaving, or are you happy on the contrary? There is probably no clear answer to this question. My approach to management is that as a manager I try to give interesting tasks to the people I work with so that they find it interesting. At some point, programming was given over to colleagues who do it much better than me. There is a frequently asked question: should a company's CTO write code or at least look
at code? And there are polar opinions on this. Here is your opinion, what is the general case and how it should be? Since I am not a technical director, but a general manager, I can do without code. The technical director of our company interacts with code, but code is not his main tool. Its main tool is people and teams. Have an idea that such code is necessary in a programming company. I mean a company that makes products for programmers. Roughly speaking, any manager in our company must hold
a conversation with a programmer for at least a few minutes so that there is an understanding that these guys know what they are talking about. Who do you respect more, managers or programmers? Programmers couldn't have managers without managers. Programmers are unlikely to achieve results. I think both are important. And when people start to oppose, programmers are good or managers are good, the result is not very good. We need to find ways to interact, and then the return on work will be much
greater. Who would you keep more in the company if a person wanted to leave, a manager or a programmer? There are managers who understand a lot about the product, about the company, about the business philosophy, and the value of such people is very high. There are programmers who know the product, who work with it for a long time, who understand how to develop this product, who understand how to support it. Therefore, I think it depends not on the type of activity that a person does, but on his
contribution to the company, his contribution to the product, and how much the person wants to further associate himself with the product, with the company. Do your managers grow from programmers, or do you hire them from outside? Most managers grew up within the company. It may seem unexpected, but in our company, in addition to programmers, approximately half of the employees are not programmers, and they also have managers. In our experience, those who grow up to be managers within a company
are easier to adapt, they understand better about the product, about the company, about the business than people who come from the street. But this is our shortcoming; we need to learn to integrate people from outside. And there are successful examples when we integrate people from outside, they are just as immersed in the project, in the product, and can also bring benefits. You have a rather specific area of ​​static analysis. And I’m wondering where you find specialists who understand this?
Or is it not important to you whether programmers understand this or not? I think that any company that works in the field of code analysis cannot afford to hire only specialists with experience in this field, because there are few such people, and they have to train people. In our experience, it is better suited when a person has an interest in this area, there is an interest in digging into the insides of complex programming tools. And if there was no experience working with such tools before,
but there is interest, then this is enough for a person to be able to have a good conversation with the subject area after some time. Where might this interest come from? Why am I asking? Because we are also connected with this area, and when programmers come to us, many of them say that they would like to do something that ends up being a product that is used by millions of people. And here is an area in which it is not even clear who the end consumer of this product is, and whether the market
will ever see it. Do you have a problem with programmers not understanding what should motivate them in this domain, in this line of work? It's a fair question. Indeed, a code analysis tool is not a product that everyone knows about or is easy to talk about. This is not a game. You can’t take out your phone and show Angry Birds if it’s clear what you’re doing. Showing a code analyzer is quite difficult. Oddly enough, programmers love to do complex, incomprehensible things. This, apparently, is
about the psychology of people who are inclined to programming. Well, at least a certain part of programmers like to do complex things. And it seems that a code analyzer is just a rather complex thing that is interesting to tinker with, interesting to understand how it all works, how it works, and what can be improved and corrected there. In short, interest is one of the key factors that causes people to engage with complex topics. Without a doubt, a code analyzer is a very complex thing, and pe
ople like the ability to do complex things. It’s always nice to tell newcomers about this, because people’s eyes light up when they realize that they can do something that their neighbor, friend, or buddy can’t do. And what can I brag about, be proud of, tell in the programming community that I do such things that no one really understands how they work. Do you hire Olympic athletes? Would you rate them compared to other programmers? Specifically, we don’t have much experience with Olympic athle
tes, because such people exist, they come into the spotlight, but they are very quickly sucked out by large companies, market leaders, and it is quite difficult to retain such people. I understand what the question is about, how suitable are the Olympiads as a set of programming activities to what people do, let’s say, conventionally in everyday life. When I myself studied, I treated the Olympiads statistically, probably because I never managed to win there, so there was always an excuse that th
is is not what not real programming, but programming associated with real life, in quotes, who would then know what real life is, this is the real thing. Now I think that Olympiad programming is a good sports discipline, it is a way to popularize programming, but to what extent people who have succeeded in this area can succeed in industrial programming, the questions here are different. - How do you generally assess within the company who is the best and who is the worst of the programmers? The
ir technical skills, their technical competencies, do you have any internal assessment mechanisms? - Several years ago we came to the concept of grades for programmers. We have written down the standard options junior, middle, senior. We understand what competencies people of a particular grade should have . We worked a lot on this and are constantly working so that people understand how they can move from junior to middle, how to move from middle to senior. This is a very important job for peop
le to see career prospects in the company. There are still teams that work without grades. I'm not talking about our company, I'm talking about other companies. My opinion is that the faster grades appear in all companies involved in development, the better people understand how to move from one grade to another, the more mature the industry will be. And things like a competency matrix, for example, which reflects the skills that programmers at one level or another should have, is a very good th
ing that helps performers, programmers and managers who are responsible for the growth of these people. Can you give an example of how a grade middle-level programmer differs from a grade senior-level programmer in terms of criteria? The simplest and most understandable criterion is initiative in solving certain problems. Senior independently understands about some problems, how to solve them, how to predict them. Middle is waiting for the situation that this problem will somehow become known. T
his is a very non-obvious criterion when you talk about it somewhere, let’s say, outside the company, but when inside, when it is connected with specific tasks, it becomes very clear why certain things at one level are inaccessible to people, and some - then the tasks become available to others. Are people not offended by such relative subjectivity in assessing their grade? Just subjectivity is removed by the fact that the grades are clearly stated and there are clear criteria for how to move fr
om one grade to another. If a decision is made by a person without comparison, for example, the manager of this employee, without comparison with any criteria, then subjectivity is very clearly visible. But if the criteria are written down, the criteria are clear, then there is very little subjectivity left. And in general, people are sympathetic to these criteria. How often does a person’s grade change? It depends on what level a person is at. The Junes' levels change quite quickly. Let’s say,
over six months to a year the level changes quite a bit, and sometimes several times in a year. Naturally, an annual change is impossible for a siner level, and people understand this. That is, a person understands the time before the level changes. Does the salary also change with the change in grade? Yes, salaries change with both grades and roles. This is another branch of development. In addition to grade, there are also roles. A person can be a technician, a designer. And these are roles th
at, in addition to grade, determine a person’s income. That is, he can move from one role to another, and at that moment his salary will change? Yes. That is, in addition to grades, these incomes can be changed with additional activities and additional roles. Are there grade downgrades? I’m trying to imagine a situation in which in modern IT someone would have a demotion, and, frankly, it seems, at least in Russia, the situation is not such that demotions would be possible. I think no, downgrade
s are now impossible on the Russian IT market. Another thing is that different rates of income growth, rates of growth of grades, levels of a person can lead to the fact that a person is not ready to stay in the company, since he does not agree with such a speed of his development. Do you think the market is now in favor of IT companies or is it against IT companies? I think it very much depends on how the company builds its business, what it does, and there are completely different options. Wha
t I mean is that in some situations companies may have an advantage in the market. A company can be attractive to employees, attractive to clients, attractive to counterparties. Everyone wants to join this company, and then she can feel relatively confident. It is clear that in general there is now a job seeker market, at least in Russia, and, probably, this will continue to happen for some time, but now courses, Skillbox, Ekebrains and similar courses are definitely influencing. They have made
it more difficult for juniors to join the industry. If, say, 10 years ago, juniors in IT were graduates of universities, often technical ones, who came to this field with understanding, now people are lured by large salaries, and when it turns out that they still need to work for some time to get a big salary, This is where disappointment occurs. Well, if we talk about the fact that people from courses, unfortunately, very often do not see themselves in IT, except for money, then this greatly ch
anges their attitude towards work. That is, you prefer university graduates, people with higher education? Yes. As a rule, students start working with us while they are still studying as part of student projects and internships, and this leads to the fact that by the time a person graduates, he already knows what awaits him. Further, if he likes what he does, if he sees himself in it, he stays. If he wants to try himself somewhere else, he may have just graduated from university, but he is a per
son with experience, and he will find a place for himself in any company. How do you feel about graduate students, candidates of sciences who have defended themselves? Are they of value to you? Any special one? I myself am a candidate of technical sciences, my dissertation was just about static code analysis. I'm calm about this. Yes, it turned out that my scientific activity and work were connected. When people achieve this within the framework of kalavra works, magnetic works, it is good, it i
s convenient for everyone. But to say that candidates of science there are fundamentally better and smarter would be wrong, because this is just a choice of one of the branches of one’s own development. A person can go into science if he likes it, a person can go into industry if, it seems to me, the conditions there are more suitable for him. A person can choose the direction for his activities. And most importantly, a person can change them many times during his life . But in your business, yo
u should be competing intensely with international companies and even with universities that develop products and technologies for static analysis. So the first question is, is this true, are you competing? And the second question is, how much science is there in your business? Because, as I understand it, to compete with such world leaders you need to invent something, something new, and scientifically substantiate something. Yes, there is competition with foreign companies, it is inevitable. F
or a long time, 80% of our sales were from the USA and Europe, but now the percentage has changed; these countries account for about half of our sales. The fact is that there are not many companies in the world that deal with this topic, but, roughly speaking, there are dozens of them, not thousands, not hundreds of thousands. And one way or another, all companies know about each other. Competition comes in several directions, and we try to take these things into account in our work. The first a
rea in which there is competition is the modernity of the instrument. If the instrument develops, if it constantly When support for new development tools and new language capabilities appears, this is always visible, and there is benefit from it. If a tool freezes and receives an update every 5 years, then such a tool is difficult to use, and people leave it. In general, the first opportunity for competition is modern development and current versions of current technology. Another direction is e
ducational marketing. We invest a lot in publications, in participating in conferences with presentations, and thanks to educational marketing, people get to know us, get to know our company, and there is a certain trust that makes it easier for people to choose a tool that they have heard something about, know something about. , saw the company, saw representatives of this company. In this way, it is possible to gain the attention of the audience, receive some kind of positive feedback, and thi
s is a way of competition. Not all companies can afford it, not everyone is able to actively work in the field of training, in the field of educational marketing. As for the question about science, it’s more complicated here. The fact is that somehow our scientific component is not very good, in the sense that, of course, there are scientific conferences, and there are people who develop their products through science. We have more experience through interaction with users, and the development o
f the tool comes through feedback from users, and not through some theoretical questions about how to do this or that thing correctly from the point of view of a scientific approach . Most likely, this is precisely our experience, and I am not saying that only it is correct, but it cannot be otherwise. The fact is that such a scientific approach is difficult to broadcast to a wide audience. You constantly have to tell in simple language, in simple words, with simple examples, what certain tools
do, how to make them work the way the user needs, and science doesn’t really help here. That is, the user comes to you without a scientific request, without purely practical requirements, he doesn’t care how competitors work, he doesn’t care what world science thinks about it, he just needs to... He has his specific project, his situation, his environment, and it needs to work for him. And due to the fact that the tools are complex, the work of one tool for a particular user does not mean at all
that another tool will work just as well. This is where a way to compete appears. In order to make your tools work, that is, find errors, you need to use some methods to find these errors. And these methods must be invented by someone. You can either take them from the literature, from already published sources, or you can come up with them yourself. Which of these paths are you following? We started with some well-known, standard error patterns, which are more or less understandable, described
in the literature, in articles. And over time, we came to the point that we either ourselves discover some new error scenarios, or they are reported by users. For example, look, here is such a construction in the code. Your tool does not find it, although it would seem that it should. And if we generalize this to some other cases, then, as a rule, we get good examples of errors. Is it possible that you are inventing something that at this moment the Synopsys company or the Veracode company is d
oing something at the same time as you and has already, for example, published a solution? This happens all the time. Companies deal with roughly understandable technologies, problems and tasks. And periodically, one company comes up with a solution earlier, sometimes another. Industry development occurs due to competition. And what was discovered by instruments 10 years ago, and what is discovered now, is not you and the earth, because a huge way has been covered in 10 years. This constant deve
lopment of tools is the key to the development of the industry as a whole. How do you compete with open-source solutions? After all, much of what you do is done simultaneously by open products. Yes, indeed, there are good practices and good solutions in open products . We love, respect, and support them because they promote the idea of ​​code analysis to the masses. At first people don’t know about this technology at all. Then they learn about some solutions and try, for example, a free open opt
ion for their tasks. Then these options are somehow not suitable for them, and they look at paid solutions. And this is where the opportunity arises not to compete with them, but to use these tools to inform people about technology in general. Don't you think that sooner or later everything will become open-source, and companies, your company, and similar companies will simply not be in demand, their products, because everything will be open-source? Is there no such threat? I treat open-source a
s a legal concept. It seems to me that a large number of open-source projects are made this way for reasons of legal interaction between the departments that make these projects. That is, in order to eliminate a bunch of additional contracts that companies sign to access code in the case of closed systems, in order to simplify this development, they make free, open-source solutions. But from a business point of view, in addition to open-source, in addition to the fact that a particular solution
is open, what and who is behind this technology plays a very important role . Firstly, this one person or at least some team, company. And on the other hand, who to contact when you need any kind of consultation, any kind of support. In the case of open solutions, free support on forums may not be enough, and companies are willing to pay money to be sure that there are people who will deal with a specific problem and, if possible, solve this problem. So support is a pretty important component th
at I think commercial companies will always exist in this space. Do you do anything in open-source? Are you posting some libraries, maybe frameworks, some mini-solutions? We have a minimum number of open items. These are some auxiliary scripts that are used by our clients and for ease of deployment they are available in open form. But this is not some significant contribution to open-source. Do you plan to make this contribution more significant, more open? Not yet, because it is not clear what
this will give. That is, we do not yet see an opportunity for ourselves to somehow use this direction. Have you ever experienced, or maybe you don’t think about, or let me rephrase, what do you think about source code leaks in open-source? The company is successful, the company has a good product, this product is available to at least 50 programmers that you mentioned. Each of them could potentially be willing to make it open-source. Is there such a threat? Have you encountered? We don't worry a
bout it. Of course, there are legally signed documents stating that this cannot be done, in case someone suddenly decides to do this. But it seems that the fear of this is not so great, because the code, once published, without development, without support, very quickly becomes outdated. And just because the code is posted, it doesn’t mean that people will stop using the solution for which they pay, since in addition to the code, they first of all receive support, they get confidence that their
problems will be solved, and it seems that These things are important and relevant for users. Aren’t you afraid of competition from ChatGPT and other artificial intelligences? We often get comments that artificial intelligence is better than any tools written by people. We have regular, so to speak, reviews of the technologies that exist in this area, until we see something there that could deprive us of our jobs. The fact is that modern solutions in the field of artificial intelligence are buil
t on the fact that there is a certain body of knowledge, this body of knowledge needs to be absorbed, it needs to be processed and some decisions can be made based on it. Tools, for example, code analyzes are based on the fact that they can find errors, not only which everyone has in large numbers, but also errors that have just appeared in the industry, associated with innovations, changes in the programming language. And until these innovations and changes become widespread, 5, or maybe 10 yea
rs will pass, and only then will chatbots learn about them, which will be able to use these results en masse, while analyzers will have been talking about this for a long time know and use such knowledge. On the other hand, of course, there is always a temptation to ask for some tool, to hope that it will fix everything and solve all the problems. It seems that this will remain a dream, at least in our field, because there are certain legal difficulties, for example, most customers are not ready
to show their code to the outside, even to some robots. Companies are legally prohibited from posting their code anywhere. And this is a significant reason why I think there will not be rapid progress in this area. To put it bluntly, until artificial intelligence becomes available locally, without the Internet completely, but with the entire database, no one will use such solutions for code checking en masse. You know, I had two stories over the last month. Very similar to each other, programme
rs who are engaged in code analysis, static analysis came to me and said that they are no longer interested in this topic, they see how the field of artificial intelligence is developing, and they want to move somewhere there, they want to quit static analysis, to which they devoted the last 5-7 years of their lives, and now go into artificial intelligence. Do you see this among programmers? Or maybe you are waiting? And how do you respond to this? There is fatigue from technology, from a specif
ic field, and people don’t necessarily go into artificial intelligence, maybe somewhere else. What to do about it? Try to make sure that people have variety in their work, to change the field of activity not radically, in the sense of giving up everything and starting to do something else, but something within the framework of some related areas. In general, this is a question of motivating people, motivation to engage in this or that area for some long time. Now, if you look, people in general
change jobs quite quickly. Roughly speaking, if a person has worked for 3 years, he is already considered a long-liver, right? For many companies, the standard situation is 1-2 years, and people have to do something about it one way or another. Most likely, first of all, this is a management problem, how to retain people, how to motivate people to stay in the company, to stay in this area. And here it is unlikely that a specific area has an influence, what a person did before, what he thinks he
wants to do now. In short, this is where managers always have headaches and will continue to have them, and this is where no artificial intelligence solutions will help us. Programmers argue that artificial intelligence will soon absorb everything. But you have already answered this question that this probably will not happen in the field of program analysis. But programmers feel it this way. They think that artificial intelligence is still 5-10 years away, and programmers will simply not progra
m anything anymore, but will only be bot operators. Do you think this is what awaits us? In principle, we can now say that a person is a programming language operator who has a very limited set of capabilities with the language syntax. And if 20-30 years ago people were worried that they could do everything with a computer, and gradually their capabilities were limited, limited, limited, but now they treat this normally, it does not bother anyone. Yes, in a sense, most, a large number of tasks w
ill be done by such means. But this was also the case in the 90s, when interface design systems appeared, when you could throw buttons on a form, and it looked like a program, and a person with knowledge of a conditional language developer could not imagine that this would ever become possible . I think this will be a certain stage in the development of programming languages. Maybe we will move away from the concept of a classical programming language for some tasks and there will be simpler too
ls, more similar to the human way of interaction, that will allow us to do something. At the same time, I think that the huge written volume of existing software will not allow us to abandon all this, to rewrite, for example, AutoCAD on some chat bots, an unrealistic task, to rewrite the operating system of a mobile phone, an unrealistic task. These are all projects that have been developed for many years and will be developed for many more years, and nothing can be done about it. Unfortunately
and fortunately, this is the industry, and it seems that revolution in this area is still a long time coming. And you, looking at the program code that you have been analyzing for the past 15 years, what conclusions can you draw about its quality as a whole? Are we as an industry writing better and better code, or are we as an industry writing worse and worse? The volume of code is growing, and because the volume of code is growing, the number of errors is growing. This does not mean that people
are getting worse, it means that the complexity of tasks is growing. The interaction of components is very complex. Dockers, containers, orchestration systems for all these tools are very complex, and very few people fight for simplicity in development . It’s very easy to make difficult, but to make it simple, understandable, very difficult. In short, people are not getting any more stupid, everything is fine with people, but the complexity in the industry is such that there are more mistakes.
And do analyzers cope with these errors, or do analyzers do their job worse and worse? Analyzers cope, and analyzers have already changed the industry in such a way that serious projects cannot be done without analyzers. People realized that this technology is workable, and that without this technology it is worse than with it. And although it does not protect 100% from problems, it also has difficulties, difficulties in implementation, difficulties in support. It's better with code analyzers th
an without them. Have you had to convince customers of this? There are interesting scenarios when people first try a tool in pilot mode, they have doubts whether it will be possible to integrate it, whether they will be able to see the benefits, whether they will be able to get a return on investment. And after some time they expand it to the entire team, to the entire project, to neighboring divisions. That is, it is difficult to convince a person of this with words, but you can make the person
convinced himself by trying, and if you help him at this moment. You said that the industry is now increasingly understanding the need for static analyzers. Apparently, 15 years ago the majority did not yet have this awareness. Yes, the industry has changed a lot, because when we started, both in the world and in Russia, it was a new topic, these were enthusiasts who were learning new things, new code analyzers in order to look for errors in their programs in order to understand are there any p
roblems there? Nowadays, many users come for analyzers because their processes, their design standards, or regulatory requirements force them to use such solutions. There is no longer a question of whether it is necessary or not necessary, in principle, to introduce such things. The question is whether we will be able to implement it specifically, make it so that it is not very difficult, so that there is a clear benefit, Well, so that you can easily understand that the costs of implementation a
nd support costs are paid off. I will ask this question, maybe, if possible. How much does your solution cost? Or in what price ranges? The minimum price for a license for a team of up to 9 people is one million rubles. The average check, the average license is 2 million rubles for a team of up to 30 people. We only have a team license, because the benefits of the analyzer go to the entire project, the entire team, and not to the specific person who runs this or that solution. Is this a per year
cost? Yes. And does this include support? Yes. About half of users need support. I mean, about half of the users come to us within a year, and half make do on their own. And if you compare the cost of your solution, say, with a Synopsys solution or with Klockwork, in terms of price? There are companies that have approximately the same prices. There are companies that sell for much more. There are probably no companies that sell cheaper. Or rather, this decision will be of a slightly different p
lan. This is a productivity tool. The price of tools is usually quite significant, because it is convenient to compare with the cost of programmers' salaries. The tool allows people to do better work. People’s work means their salaries, and accordingly, the connection with salaries is more or less clear to customers. And if this solution costs significantly more, someone else’s solution, for example, Caverity, it seems to me, costs about 2 thousand dollars per workplace, that is, with 9 or 10 wo
rkplaces it will be 2 times more expensive than your solution, at least. Will their solution be better or is it just more expensive because the country of origin is different? We have clients who came to us from different manufacturers and from different developers, and they say that technically this is not necessary, there is some fundamental difference, that is, it is not that a solution that is more expensive is just as much better . Rather, it is experience in selling expensive projects, exp
erience in implementing it on a large team, and due to this they can sell more expensively. And if right now, right today, one of our listeners wants to start the same business as yours, to become your competitor, the first question is whether he will succeed, and the second question is how long will it take him to catch up with your product in terms of functionality, and then surpass it, what do you think? It seems quite difficult to do business in this area now. On the one hand, there is a sol
ution in the form of Clang, based on which people are trying to do something of their own. On the other hand, the topic is very complex, and it will take several years for a team to immerse itself in this area in any case. Naturally, we interact with colleagues in the market, and we see that sometimes they try to make some decisions that, roughly speaking, are made from scratch. It turns out that this is very difficult, it requires a lot of effort, time, and, accordingly, money. It is unlikely t
hat anything can be done in this area completely from scratch now. The time that will have to be invested in understanding this topic is in any case measured in years for the team. - When you built your business, did you receive investments from outside? Or did you build it at your own expense? - No, we still do everything on our own. It makes sense to receive investments when it is clear how to spend a ruble to get 10 rubles. In our field, we don’t yet know such methods, so we still manage with
out investment and work with our own money. - Can you dream up and name some areas now in your field or adjacent to yours, in which those listeners who are listening to us now should invest , and spend several years, and create something new? Not a static analyzer, like yours, but something that can be done, and that may not yet exist. - I think that fantasies in this area do not work very well. Observation works. That is, you need to observe what is missing in some subject area, and try to offe
r this solution. That is, do not try, let’s say, while sitting on a chair to invent something, but while working in the area where, for example, you already work, observe what is missing. This is how different solutions appear, which over time, perhaps, gain fame and popularity. If we talk about specifics, it is clear that now, for example, there is a lot of interest in the topic of artificial intelligence , and everyone wants to go there. The question of whether this is a good idea and whether
it will be possible to compete with the leaders of this industry is not obvious. - Do such revolutionary ideas appear within your company , some branches from the main business, which you, perhaps, support, or, perhaps, on the contrary, discard as a distraction? - We have several internal tools that have shown their effectiveness during their existence. These tools are not ready for the outside world, for use outside, but they turned out to be very successful for us , and the fact that we invest
ed in them was not in vain. For example, we have a system for publishing documents on the website. We prepare all materials in Word, in Word format, and using our own program we convert it for posting on the site, for posting on our site, for posting on other sites, in different formats, in Markdown, in Google Code and so on . And the development of such a system allowed us to make very high-quality publications that could not have been done without such a system. In this system we have a built-
in check for some typical errors for our cases, some special situations are incorrect, because our articles contain a lot of source code, and this code, when published by standard systems, is often distorted, lost in symbols, and confused in formatting. So we can check such things. In short, this bike turned out to be very successful from the outside, and we have been using it for many years, and every time we are happy when, with the help of it, we manage to break and correct some problems . We
have a self-written CRM, with the help of which we interact with people who request prices, request trials, and such a system, again, from the outside it may seem that there is amoCRM, there is Bitrix, there is HubSpot and many other ready-made solutions, but The amount of business logic that is implemented in our system is quite significant, and implementing the same business logic on some other systems would be just as difficult, and maybe even more difficult, as on your own system. In short,
we are very actively using internal projects as a way to increase one’s own productivity and as a change of activity for people who are a little bored, say, with their main area of ​​work, have the opportunity to engage in third-party projects, internal ones. Was it an initiative from below or from above to create these two systems? This was a grassroots initiative, because people began to notice that doing something manually was inconvenient, and that it could be automated. Since the programmi
ng spirit in the company is very strong, automating one’s own work in this way turned out to be very useful. I’ll turn a little towards science again. Do you interact with universities in any way? Maybe you give lectures somewhere? Yes, all the time. I myself am not currently engaged in any scientific activities and do not give lectures, but our company constantly interacts with our local universities. Students come to us for practice, we talk about the fact that there is such a field of code an
alysis, and students find it very interesting. Overall, working with students is one of our competitive advantages. We are good at it and we love it very much. Do you provide any free versions of your product for scientists to test and analyze? Yes, we have ways to use the tool for free. They are quite comfortable. That is, this... The website describes a little how to use it. This allows both students and people in science to fully use the tool without paying. And if, let’s say, some scientist
contacts you and says that he wants to take your tool and analyze its properties, its capabilities in comparison with some tools, say, competitors and open-source solutions, and then publish such an article where you can show where your tool coped with the error, where it didn’t find it, where it found it, and make some kind of general table showing which tool works better where. Would you agree to this? Such articles appear from time to time. We ourselves used to make comparisons, but then we s
topped doing them because it turned out to be a very thankless job. If you make the comparison method as carefully as possible, describe it in detail, and then publish the results, then it is very possible that the first comment will be “You set everything up, you are lying.” And it’s very difficult to say to this, “Well, well, look, we did a description of the comparison methodology, we laid out everything.” No, you're lying. So they will think that you are promoting yourself through this artic
le? Either yourself, or the one who won in certain categories. The fact is that it is very difficult to compare tools; there are a lot of parameters by which they would need to be compared. And for users we answer like this. You try different tools for yourself, see which one suits you specifically in your project, finds errors better, which is more convenient for you to work with, and in which you understand the messages about these errors. That is, the most correct way is to try the tool for y
ourself and hope that you understand the messages from this tool. Sometimes it's not always easy. In general, as a user, I have the feeling from the static analysis market that there are practically no free static analyzers. At least for Java, I don’t know anything serious. I know style checkers who check formatting and find some minor cosmetic errors. But serious static analysis cannot be done by free solutions. I have this feeling of some kind of emptiness in the market, an open-source emptine
ss. I'm still waiting for someone to finally say, when someone will come out... give their solution to open-source, but so far this has not happened, for many years. Don’t you have the feeling that it’s as if... This is a very expensive field. It is very difficult to maintain enthusiastic development for a long time without any commercial approaches. For example, in C++ there is such a popular CPT-check tool. It's about as old as it's been around. And in 2021 they turned into a commercial compan
y and will sell commercial solutions. Why? Because it is impossible to develop such topics without funding. And in principle, from a Java point of view, SonarQube, a Java analyzer, works well. It is not super powerful, but if you want to get acquainted with code analysis technology, SonarQube has a good Java analyzer. Do you think there is competition in this market, does it help us? And I’m talking about the competition of really dozens of companies that really do the same thing. You do what So
narQube does, you do what you cover, and so on. You can continue this series. You're all doing the same thing, and every company spent its 10-15 years creating what the competition already had. Is this a good model, or maybe it would be more effective if we had one or maybe two large companies that would combine the efforts of tens, hundreds, maybe thousands of programmers together? Well, this happened with browsers, yes, there is Chrome, and, in general, all solutions surround it in one way or
another in the modern world. But this did not happen with code analyzers. We can say that the Clang solution claims to be in this area, but many projects cannot use Clang, and it has not yet become a single tool that suits everyone. It's hard to say whether this will ever happen. Microsoft, for example, appeared with code analyzers, but these were separate projects, which, not to say, found, again, great popularity and became industry standards. For some reason, apparently, one supplier cannot m
ake a universal solution. Perhaps the point is that clients’ needs are too complex and atypical. Well, my last question is about the geopolitical situation. Have you somehow felt the problems associated with geopolitics, have they somehow affected your business? And the second question, do you have any thoughts about moving your business, for example, from Russia to some Western European country? As I said, for a long time we had many clients from the USA and Europe, there are difficulties with
payments, companies and people are ready to work with us, they do not refuse, but there are technical difficulties, there are difficulties on the part of regulators, some companies cannot interact with Russian companies. We have a division in Kazakhstan, which was created in order to interact with Western companies. In general, we are not yet planning to move more globally. And for the people who are your clients, for them the product is from Russia, it seems to you, this is some kind of exotic
that is interesting to them, or this is something that they would like to distance themselves from over time or return or switch to products that are close to them, which ones are geographically closer to them? I believe that those who would like to distance themselves simply do not come to us, and we do not communicate with them. With whom we communicate, most likely, everything is normal about this, that is, a certain mistake is revealed in person. Those for whom this is critical probably simp
ly do not reach us. And programmers, did you feel any outflow of people due to recent events, or did everyone remain in their places? Part of our team works in Kazakhstan in order to provide support to our clients outside of Russia. In general, of course, the situation is difficult, no one likes it, everyone wants peace. That's it, I asked everything I wanted. Thanks a lot. It was very interesting. I would certainly like to try the product. I can say that we tried to do the kind of study that I
talked about, to compare several products. This was two years ago. We wrote e-mails to different companies, this was before this whole political situation. And we were told that this is extremely difficult, we need to write a letter directly from the university, that is, prove that we belong to the university, and they will consider both. And they somehow looked at this idea without much enthusiasm, where we would compare their products with others. And we eventually refused this, and we didn’t
take your product either, because we didn’t have a quorum, and it’s not interesting to compare only PVS-Studio, say, with one other product. But I have not seen such analyzes on the market. That's why we were interested then. All the analyzes that are carried out, the quality of these analyzers, they are mainly considered open-source solutions. Well, since they're open, it's easy to do. And it would be very interesting to see commercial solutions. Therefore, maybe we will return to this topic, a
nd then I will write to you, maybe you will be ready. I'll be glad to help.

Comments