Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoKart: A static analysis tool for securing Go code

github.com

Post reply on HN
Print view View original

21–30 of 88 posts

Re: GoKart: A static analysis tool for securing Go code

#21

Post by brundolf »

jacques_chester wrote: post #20
brundolf wrote: post #10

I've wondered what it would be like to write a thin language that compiles to Go and mainly serves to introduce a reasonable type system on top, while benefitting from its performance and garbage-collection. Could prevent null dereferencing, among other things

I think your difficulty would be in finding interested users. People who like Go, like Go, warts and all. Everyone else has heaved a sigh of relief and decamped to other languages.

To be clear, I'm not suggesting that I personally would be able to bootstrap this (and the tooling, and the declarations for existing libraries, etc) and have it take off

But if I saw it pop up on HN I'd jump on board in a heartbeat

Go has a lot of compelling benefits around compiling, performance, concurrency, etc that I think would translate. It just made a couple of really unfortunate decisions around null pointers and default values that turn a lot of people off. I think salvaging it from those unfortunate decisions would be worth doing for the right party with the resources to do so, and I think it would appeal to a lot of people

I'm not even sure I would want generics to be added, since that's an elephant in this particular room. I just want to be able to have a mote of confidence in the values I'm working with.

Re: GoKart: A static analysis tool for securing Go code

#22

Post by noisy_boy »

brundolf wrote: post #10

I've wondered what it would be like to write a thin language that compiles to Go and mainly serves to introduce a reasonable type system on top, while benefitting from its performance and garbage-collection. Could prevent null dereferencing, among other things

I wrote one component in go - it does everything that is expected from it with good performance without having to deal with virtualenv/jvm dependencies. However I don't want to write that much code again. Only of there was a language with ecosystem/brevity/garbage collection of Java, strong type system/pattern matching of Rust, excellent multi-threading of go and produced a dependency free binary.

Re: GoKart: A static analysis tool for securing Go code

#23

Post by izgzhen »

SquishyPanda23 wrote: post #3
the-smug-one wrote: post #2

Go has some nice tooling which is quite easy to use w.r.t. static analysis. I started writing a nil pointer analysis tool which was going to take advantage of and provide some more advanced information*. I "unfortunately" had a lot more fun stuff to do during my vacation, but it was very easy to get started with! So kudos to the Go team for making this kind of stuff possible for a 1-man team. * Just a forward-style a…

> I started writing a nil pointer It still boggles my mind that Go decided to force programmers to worry about nil pointers.

Golang doesn’t have a proper generics support at its beginning. It is too late now.

Re: GoKart: A static analysis tool for securing Go code

#24

Post by marwis »

still_grokking wrote: post #17
joshdev wrote: post #8

Earlier quoted context omitted.

Somebody has used Scala

More likely a Java lib form Scala than Scala as such. In "pure" Scala (not in the FP sense, but just without mixing with Java) something like that is almost impossible.

Unless something drastically changed in Scala 3, there is nothing to protect you from null in Scala. In fact even Java is effectively safer thanks to all the null checking done by IntelliJ

Re: GoKart: A static analysis tool for securing Go code

#26

Post by still_grokking »

noisy_boy wrote: post #22
brundolf wrote: post #10

I've wondered what it would be like to write a thin language that compiles to Go and mainly serves to introduce a reasonable type system on top, while benefitting from its performance and garbage-collection. Could prevent null dereferencing, among other things

I wrote one component in go - it does everything that is expected from it with good performance without having to deal with virtualenv/jvm dependencies. However I don't want to write that much code again. Only of there was a language with ecosystem/brevity/garbage collection of Java, strong type system/pattern matching of Rust, excellent multi-threading of go and produced a dependency free binary.

Scala Native probably.

But I've never used it so not sure how mature it is.

https://scala-native.org/

The other Go alternative I see is D.

Close to the metal but with high level features. Runs in a managed runtime. Creates native code.

https://dlang.org/

Re: GoKart: A static analysis tool for securing Go code

#27

Post by smabie »

brundolf wrote: post #14
hardwaregeek wrote: post #12

Earlier quoted context omitted.

Like a TypeScript for Go? We could call it Tolang.

That's the idea! I use Rust for a lot of personal projects mainly because of the type system, not because it doesn't have GC. I think GC's totally livable for a great many things, and it would help iteration speed a lot to not have to deal with the borrow-checker, but I just can't stand working in a language with a shaky type system these days. So Go-with-good-types sounds fantastic to me.

How about OCaml?

Re: GoKart: A static analysis tool for securing Go code

#28

Post by still_grokking »

marwis wrote: post #24
still_grokking wrote: post #17

Earlier quoted context omitted.

More likely a Java lib form Scala than Scala as such. In "pure" Scala (not in the FP sense, but just without mixing with Java) something like that is almost impossible.

Unless something drastically changed in Scala 3, there is nothing to protect you from null in Scala. In fact even Java is effectively safer thanks to all the null checking done by IntelliJ

Null is basically non-existent in idiomatic Scala. So technically you're right but besides calling Java libs there is only an infinitesimal small chance to get NPEs form Scala code. (Scala's NPE is the MatchException ;-)).

For Scala 3 there are improvements. It's "null safe" as long as you opt-in (modulo Java libs, and of course doing stupid things like casting a null to some other type).

https://docs.scala-lang.org/scala3/reference/other-new-featu...

Re: GoKart: A static analysis tool for securing Go code

#29

Post by tbarbugli »

mattnewton wrote: post #13
logical42 wrote: post #7

Earlier quoted context omitted.

You know what's fun? Getting a nil where you are supposed to have an Optional.

Afaik this is impossible in swift and kotlin, only optional values can contain nill.

Try Core Data with Swift and you will see that happening. Lazy objects (vaults) are mapped from objc into Swift and will happily crash on something like a = b where both are not optional.

Re: GoKart: A static analysis tool for securing Go code

#30

Post by brundolf »

smabie wrote: post #27
brundolf wrote: post #14

Earlier quoted context omitted.

That's the idea! I use Rust for a lot of personal projects mainly because of the type system, not because it doesn't have GC. I think GC's totally livable for a great many things, and it would help iteration speed a lot to not have to deal with the borrow-checker, but I just can't stand working in a language with a shaky type system these days. So Go-with-good-types sounds fantastic to me.

How about OCaml?

I've heard the tooling and general ecosystem are not great (similar to Haskell), though I don't know firsthand
Post reply on HN