Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Prospector: Python Static Analysis for Humans

blog.landscape.io

Post reply on HN
Print view View original

11–20 of 22 posts

Re: Prospector: Python Static Analysis for Humans

#11

Post by ekimekim »

"you will consider most of the warnings that come from tools like pylint or pep8 or pyflakes to be a bit picky."

I use pyflakes, and out of the box it doesn't give ANY stylistic warnings, only basic "I don't think this variable exists" and common symptoms of typos like unused variables and overwriting a local var with a loop variable (I suppose you could argue that that could be a stylistic choice, but the intention is to catch errors, not correct your code style).

Re: Prospector: Python Static Analysis for Humans

#12

Post by chair6 »

"The whole purpose of this project is to get people using static analysis. I think they're an excellent resource for projects and can help you find problems in your code and even learn new things." -- agreed! I'm looking forward to having a play with Prospector.

For those who are interested in this, check out the security-focused Python static analysis tool that I built an initial PoC for and we've been building out within the OpenStack Security Group. The Bandit project page is at https://wiki.openstack.org/wiki/Security/Projects/Bandit and the code at https://github.com/stackforge/bandit.

Re: Prospector: Python Static Analysis for Humans

#13

Post by abecedarius »

ekimekim wrote: post #11

"you will consider most of the warnings that come from tools like pylint or pep8 or pyflakes to be a bit picky." I use pyflakes, and out of the box it doesn't give ANY stylistic warnings, only basic "I don't think this variable exists" and common symptoms of typos like unused variables and overwriting a local var with a loop variable (I suppose you could argue that that could be a stylistic choice, but the intention…

I've tried all three, and pyflakes is the only one I'd keep using regularly. I agree that the OP misrepresents pyflakes.

Re: Prospector: Python Static Analysis for Humans

#14

Post by afarrell »

sbochins wrote: post #2

I think a better alternative is to use python mode for vim and get all the static analysis checks as you're coding. I tend to do half my development using an IDE (java/scala), but I don't really miss any of those features using this great plugin and vim.

I should take another crack at installing python-mode for vim. Last time I did, I spent an hour at it and it ended up taking 10s to register any entered text. I didn't know how to debug stick a debugger or logger into vim plugins, so I just gave up. Sometime when I have more patience, I'll give it another try and maybe produce an actual bug report.

Anyone happen to know a good way to debug vimscript?

Re: Prospector: Python Static Analysis for Humans

#15

Post by afarrell »

the_mitsuhiko wrote: post #6

This "for humans" trend really needs to stop :)

Why? So long as it doesn't get watered down and actually meaningfully indicates "I've made a serious effort to think about the user interaction and engineering psychology issues involved in my design.", I think its a trend that advances the industry.

Re: Prospector: Python Static Analysis for Humans

#17

Post by rcfox »

president wrote: post #16

How do all these libraries check comments? As far as I know, the Python ast library does not parse comments?

They check for docstrings. From PEP 257[0]: "A docstring is a string literal that occurs as the first statement in a module, function, class, or method definition. Such a docstring becomes the __doc__ special attribute of that object."

[0] http://legacy.python.org/dev/peps/pep-0257/

Re: Prospector: Python Static Analysis for Humans

#18

Post by carlio »

president wrote: post #16

How do all these libraries check comments? As far as I know, the Python ast library does not parse comments?

Comments are available after tokenisation (https://docs.python.org/2/library/tokenize.html). They're indeed not in the AST but you can get at them for analysis.

Re: Prospector: Python Static Analysis for Humans

#19

Post by carlio »

joelthelion wrote: post #8

Is there a way to use it with YouCompleteMe/Syntastic?

There is not right now, although I hope to add some plugins for common IDEs and editors. You may have success using https://github.com/davidhalter/jedi-vim though - the guy who writes it is adding static analysis.

Re: Prospector: Python Static Analysis for Humans

#20

Post by carlio »

chair6 wrote: post #12

"The whole purpose of this project is to get people using static analysis. I think they're an excellent resource for projects and can help you find problems in your code and even learn new things." -- agreed! I'm looking forward to having a play with Prospector. For those who are interested in this, check out the security-focused Python static analysis tool that I built an initial PoC for and we've been building out…

Bandit looks like a really great addition to the various Python checking tools. Expect some pull requests soon!
Post reply on HN