Live data from Hacker News

GoKart: A static analysis tool for securing Go code

github.com

51–60 of 88 posts

Re: GoKart: A static analysis tool for securing Go code

#51

I've wondered what it would be like to write a thin language that compiles to Go and mainly serves to introduce a reasonable type system on top, while benefitting from its performance and garbage-collection. Could prevent null dereferencing, among other things

Like a TypeScript for Go? We could call it Tolang.

Or Kotlin, KOlang.

Re: GoKart: A static analysis tool for securing Go code

#52

Earlier quoted context omitted.

It is super weird to me that no big compile-to-Go languages have emerged. It doesn't seem like anyone is even trying! Why not?

> Why not? Why? What would be the point except as a personal challenge?

Most criticisms of Go could be adressed by a language with a Hindley-Milner type system: https://go.dev/blog/survey2020/missing_features.svg from https://go.dev/blog/survey2020-results. Having a ML-like that compiles to Go could solve all those issues, while still keeping the great ecosystem that Go managed to build. Just like with Scala, this new language could allow people to see if that's what they really want, and offers to the Go team possibilities of evolution without the need to commit completly to them.

Re: GoKart: A static analysis tool for securing Go code

#53
post #34

Earlier quoted context omitted.

Then it boggles your mind that Go functions the way most popular languages work. You don't see so much dunking on Python, Java, Clojure, Ruby, &c, over this, even though these languages dominate the leaderboards. Which is fine, except that this is probably the second-most boring critique of Go, one virtually everyone has heard before, and it has little if anything to do with the story we're actually commenting on, de…

- MyPy doesn't have pervasive nullability, but distinguishes nullable and non-nullable types in the type system. A function declared to return int but randomly returns None has a bug in its type hints. - I dunk on Java for pervasive nullability too (though there are tools that add @Nullable xor @NonNull annotations used for analysis, possibly sound). But Go has over a decade more hindsight and should've known better.…

> [Python] distinguishes nullable and non-nullable types in the type system. A function declared to return int but randomly returns None has a bug in its type hints.

Go distinguishes between the two too. You cannot pass nil as a value to int. In fact in Go you'd get a compiler warning[0] so you don't even need to rely on type hints and a properly set up CI/CD pipeline to catch said faults:

The problem with Go is that pointers can be nullable[1] as well as interfaces[2] (interfaces, crudely speaking, being Go's solution to generics and inheritance. Crudely speaking. So interfaces get used a lot).

There is some logic to them being nullable if you think about the code from a hardware perspective but given how opinionated the compiler and language is, I feel they could have done more to catch accidental nils to save the developer from having to consciously consider them each time.

[0] https://play.golang.org/p/BADNnw08hoo

[1] https://play.golang.org/p/b39tY1SDQtZ

[2] https://play.golang.org/p/Fsjsa_-o7Qb

Re: GoKart: A static analysis tool for securing Go code

#54
post #48

Earlier quoted context omitted.

>You don't see so much dunking on Python, Java, Clojure, Ruby, &c, One of the common arguments now for why C# is superior to Java is that it supports non-nullable references. As does C++, which for large latency-sensitive projects is generally picked over C.

I'd say it has been a better designed language for sure, which wasn't that hard since they just needed to take a look where Java messed up. So many things are obvious in hindsight so it's not a fair comparison. Regarding platform and reach, Java still wins i guess. Disclaimer: Using neither.

C# has a higher rate of change than Java and a very strong ecosystem - albeit not quite as strong as Java. The tooling - if you pay for it - is in my opinion much better.

The thing is, the Java ecosystem is insane. What else comes close to it in breadth and quality? Python, Go, Ruby etc certainly don't. C++?

Re: GoKart: A static analysis tool for securing Go code

#56
. I've suffered with HIV/AIDS ever since I was a child but it's only been the last few years I discovered that I also have herpes virus . So I started looking for a way to get cure permanently from this deadly virus I visited so many hospitals in search for a solution.Few month ago I came across a site where a lady was sharing a testimony about Dr Godwin and how he cured HIV/AIDS virus and all kinds of diseases with natural herbs so I decided to give it a try and i messaged Doctor Godwin he told me how I was going to get the herbs so I did as he instructed few days later I received the herbs and I started taking the herbs as instructed by the Dr.I was shocked two weeks later my doctor told me that I was free from HIV/AIDS so I decided to let the world know how I was cured from HIV/AIDS by Dr godwin. you can reach him through his drgodwinharbs@gmail.com Or WhatsApp/call +234 8089906968.If you also want cure for your herpes or any of the disease listed below Dr godwin also cure the listed diseases below 1,Weight loss 2,cancer 3,herpes virus 4,high blood presure 5,diabetes 6,Skin rashes 7,Swollen lymph glands 8,Pneumonia Memory loss 9,Sores of the mouth, anus, or genitals 10,HIV/AIDS 11,Penis enlargement etc Goodluck call or wattsapp [+2348089906968 ] dr godwin website link --- [ https://drgodwinharbalhomecure22.simdif.com/ ] God bless you dr Godwin for what you did for me and my family he is so real and reliable

Re: GoKart: A static analysis tool for securing Go code

#57
post #34

Earlier quoted context omitted.

> I started writing a nil pointer It still boggles my mind that Go decided to force programmers to worry about nil pointers.

Then it boggles your mind that Go functions the way most popular languages work. You don't see so much dunking on Python, Java, Clojure, Ruby, &c, over this, even though these languages dominate the leaderboards. Which is fine, except that this is probably the second-most boring critique of Go, one virtually everyone has heard before, and it has little if anything to do with the story we're actually commenting on, de…

Golang wasn't designed in the 1990s.

I'm sorry you're bored and also annoyed in the possible universe where GoKart is your project. But it seems like this is a thing people want to talk about in a post about Go static analysis tooling.

I don't see why you're trying to police HN conversations.

Re: GoKart: A static analysis tool for securing Go code

#58
post #5

Earlier quoted context omitted.

Optionals would have been a way to solve this problem

So you get an Optional which haven't been set instead of a nil pointer. What's better about that?

The type system knows about it and you're forced to check it

Re: GoKart: A static analysis tool for securing Go code

#59

Earlier quoted context omitted.

So you get an Optional which haven't been set instead of a nil pointer. What's better about that?

The type system knows about it and you're forced to check it

Right, but my point is, the code which would raise an error because the pointer is nil now raises an error because the Optional is not set.

Is there really that much of a difference between those cases?

I agree though that in an interface, Optional conveys a more explicit meaning than something pointer-like, which is always a good thing.

Re: GoKart: A static analysis tool for securing Go code

#60
post #34

Earlier quoted context omitted.

Then it boggles your mind that Go functions the way most popular languages work. You don't see so much dunking on Python, Java, Clojure, Ruby, &c, over this, even though these languages dominate the leaderboards. Which is fine, except that this is probably the second-most boring critique of Go, one virtually everyone has heard before, and it has little if anything to do with the story we're actually commenting on, de…

Golang wasn't designed in the 1990s. I'm sorry you're bored and also annoyed in the possible universe where GoKart is your project. But it seems like this is a thing people want to talk about in a post about Go static analysis tooling. I don't see why you're trying to police HN conversations.

ML was designed in 1976.
Post reply on HN