Live data from Hacker News

GoKart: A static analysis tool for securing Go code

github.com

31–40 of 88 posts

Re: GoKart: A static analysis tool for securing Go code

#31

I've wondered what it would be like to write a thin language that compiles to Go and mainly serves to introduce a reasonable type system on top, while benefitting from its performance and garbage-collection. Could prevent null dereferencing, among other things

It is super weird to me that no big compile-to-Go languages have emerged. It doesn't seem like anyone is even trying! Why not?

Re: GoKart: A static analysis tool for securing Go code

#33
post #27

Earlier quoted context omitted.

That's the idea! I use Rust for a lot of personal projects mainly because of the type system, not because it doesn't have GC. I think GC's totally livable for a great many things, and it would help iteration speed a lot to not have to deal with the borrow-checker, but I just can't stand working in a language with a shaky type system these days. So Go-with-good-types sounds fantastic to me.

How about OCaml?

+1 After learning OCaml & experiencing algebraic data types and pattern matching, writing in other languages just makes me want to switch to OCaml

Re: GoKart: A static analysis tool for securing Go code

#34

Go has some nice tooling which is quite easy to use w.r.t. static analysis. I started writing a nil pointer analysis tool which was going to take advantage of and provide some more advanced information*. I "unfortunately" had a lot more fun stuff to do during my vacation, but it was very easy to get started with! So kudos to the Go team for making this kind of stuff possible for a 1-man team. * Just a forward-style a…

> I started writing a nil pointer It still boggles my mind that Go decided to force programmers to worry about nil pointers.

Then it boggles your mind that Go functions the way most popular languages work. You don't see so much dunking on Python, Java, Clojure, Ruby, &c, over this, even though these languages dominate the leaderboards.

Which is fine, except that this is probably the second-most boring critique of Go, one virtually everyone has heard before, and it has little if anything to do with the story we're actually commenting on, despite having spawned a huge thread about option types.

If GoKart had been my project, I'd be annoyed.

Re: GoKart: A static analysis tool for securing Go code

#35

I've wondered what it would be like to write a thin language that compiles to Go and mainly serves to introduce a reasonable type system on top, while benefitting from its performance and garbage-collection. Could prevent null dereferencing, among other things

v-lang ? https://vlang.io/

Re: GoKart: A static analysis tool for securing Go code

#36
post #27

Earlier quoted context omitted.

How about OCaml?

I've heard the tooling and general ecosystem are not great (similar to Haskell), though I don't know firsthand

I've personally found it really good, probably better than Haskell. Not Go level though I imagine.

Re: GoKart: A static analysis tool for securing Go code

#37

I've wondered what it would be like to write a thin language that compiles to Go and mainly serves to introduce a reasonable type system on top, while benefitting from its performance and garbage-collection. Could prevent null dereferencing, among other things

I suspect in part it's a combination of 1) Go is good enough as is (and some people don't mind Go's simple type system or the boilerplate-y but explicit error handling), and 2) the Go tooling is really good -- "go build", "go test", etc, would all have to be wrapped or rewritten with slower, buggier versions.

Re: GoKart: A static analysis tool for securing Go code

#38
post #34

Earlier quoted context omitted.

> I started writing a nil pointer It still boggles my mind that Go decided to force programmers to worry about nil pointers.

Then it boggles your mind that Go functions the way most popular languages work. You don't see so much dunking on Python, Java, Clojure, Ruby, &c, over this, even though these languages dominate the leaderboards. Which is fine, except that this is probably the second-most boring critique of Go, one virtually everyone has heard before, and it has little if anything to do with the story we're actually commenting on, de…

- MyPy doesn't have pervasive nullability, but distinguishes nullable and non-nullable types in the type system. A function declared to return int but randomly returns None has a bug in its type hints.

- I dunk on Java for pervasive nullability too (though there are tools that add @Nullable xor @NonNull annotations used for analysis, possibly sound). But Go has over a decade more hindsight and should've known better.

I haven't used the other languages.

Re: GoKart: A static analysis tool for securing Go code

#39
post #34

Earlier quoted context omitted.

Then it boggles your mind that Go functions the way most popular languages work. You don't see so much dunking on Python, Java, Clojure, Ruby, &c, over this, even though these languages dominate the leaderboards. Which is fine, except that this is probably the second-most boring critique of Go, one virtually everyone has heard before, and it has little if anything to do with the story we're actually commenting on, de…

- MyPy doesn't have pervasive nullability, but distinguishes nullable and non-nullable types in the type system. A function declared to return int but randomly returns None has a bug in its type hints. - I dunk on Java for pervasive nullability too (though there are tools that add @Nullable xor @NonNull annotations used for analysis, possibly sound). But Go has over a decade more hindsight and should've known better.…

[deleted]
Post reply on HN