Находки в опенсорсе

Rust Memory Safety & Undefined Behavior Detection.

Rudra is a static analyzer to detect common undefined behaviors in #rust programs. It is capable of analyzing single Rust packages as well as all the packages on crates.io.

Features:
- Panic Safety (Unsafe code that can create memory-safety issues when panicked)
- Higher Order Invariant (Assumed properties about traits)
- Send Sync Variance (Unrestricted Send or Sync on generic types)

https://github.com/sslab-gatech/Rudra

​​A static analysis tool for securing #go code

GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA (single static assignment) form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces the number of false positives compared to other Go security scanners. For instance, a SQL query that is concatenated with a variable might traditionally be flagged as SQL injection; however, GoKart can figure out if the variable is actually a constant or constant equivalent, in which case there is no vulnerability.

The motivation for GoKart was to address this: could we create a scanner with significantly lower false positive rates than existing tools? Based on our experimentation the answer is yes. By leveraging source-to-sink tracing and SSA, GoKart is capable of tracking variable taint between variable assignments, significantly improving the accuracy of findings. Our focus is on usability: pragmatically, that means we have optimized our approaches to reduce false alarms.

https://github.com/praetorian-inc/gokart

​​Vieb is the Vim Inspired Electron Browser

Features:
- Free, open source, fast and secure
- Local first adblocking, auto-complete, AMP protection, custom redirects and more, all without web requests
- Privacy with strict permission system, navigator overrides, firefox mode, custom WebRTC policy and more
- Accessible with custom themes, full interface & fontsize scaling, page zooming, spellcheck and mouse support
- Security settings with permissions, cache usage, cookie management, (auto-)download settings and more
- Window splitting with buffer, split, Vexplore and Ctrl-w bindings, for multi-window browsing
- Map commands for completely custom keyboard sequences, keystrokes, commands and actions
- Viebrc config file for all custom/Vim/Vieb commands to configure settings permanently
- Set command for runtime setting configuration exactly like Vim
- Vim-compatible options: showcmd, timeout, colorscheme, maxmapdepth, spelllang, splitright, smartcase etc.
- Container tabs with colored grouping, auto-clearing, individual cookies and tab restore from containers
- Ad-blocker with cosmetic filtering, optional updater, custom lists and uses easylist/easyprivacy by default
- Tabs including audio indicator, a toggle for multi-line tabs, pinned tabs, muted tabs and suspended tabs

https://vieb.dev/

#js

The open-source #js Calendly alternative.

Let's face it: Calendly and other scheduling tools are awesome. It made our lives massively easier. We're using it for business meetings, seminars, yoga classes and even calls with our families. However, most tools are very limited in terms of control and customisations. That's where Calendso comes in. Self-hosted or hosted by us. White-label by design. API-driven and ready to be deployed on your own domain. Full control of your events and data. Calendso is to Calendly what GitLab is to GitHub.

Personal opinion: why paying for Calendly, when you can deploy everything to K8S pay for your own infrastructure and manage it yourself?!

https://github.com/calendso/calendso

​​Kind: A modern proof language.

A minimal, efficient and practical proof and programming language. Under the hoods, it is basically Haskell, except purer and with dependent types. That means it can handle mathematical theorems just like Coq, Idris, Lean and Agda. On the surface, it aims to be more practical and looks more like TypeScript.

Compared to other proof assistants, Kind has:
- The smallest core. Check FormCore.js or Core.kind. Both are < 1000-LOC complete implementations!
- Novel type-level features. Check out article on super-inductive datatypes.
- An accessible syntax that makes it less scary
- A complete bootstrap: the language is implemented in itself. Check it here.
- Efficient real-world compilers. Check http://uwu.tech/ for a list of apps. (WIP)

Things you can do with it:
- Compile programs and modules to several targets, right now js and scm are supported
- Create live applications. Kind has an interconnected back-end that allows you to create rich, interactive applications without ever touching databases, TCP packets or messing with apis
- Prove theorems: for programmers, they're more like unit tests, except they can involve symbols, allowing you to cover infinitely many test cases. If you like unit tests, you'll love theorems.

Personal opinion: I am a big fan of ML-family languages, but not a big fan of their syntaxes. I love that new products solve their biggest issue for me. I really hope that some of these new functional languages will get eventually popular.

https://github.com/uwu-tech/kind

#js #haskell

​​Bit is a modern Git CLI.

bit is an experimental modernized git CLI built on top of git that provides happy defaults and other niceties:
- command and flag suggestions to help you navigate the plethora of options git provides you
- autocompletion for files and branch names when using bit add or bit checkout
- automatic fetch and branch fast-forwarding reducing the likelihood of merge conflicts
- suggestions work with git aliases
- new commands like bit sync that vastly simplify your workflow
- commands from git-extras such as bit release & bit info
- fully compatible with git allowing you to fallback to git if need be
- get insight into how bit works using bit --debug

https://github.com/chriswalz/bit

#git #go

​​The Open Source Airtable alternative.
Turns any MySQL, PostgreSQL, SQL Server, SQLite & MariaDB into a smart-spreadsheet.

Features:
- Search, sort, filter, hide columns with uber ease
- Create Views: Grid, Gallery, Kanban, Gantt, Form
- Share Views: public & password protected
- Upload images to cells (Works with S3, Minio, GCP, Azure, DigitalOcean, Linode, OVH, BackBlaze)
- Roles: Owner, Creator, Editor, Commenter, Viewer, Commenter, Custom Roles
- Access Control: Fine-grained access control even at database, table & column level
- Programmatic APIs via REST and GraphQL

Personal opinion: I love #nocode instruments like this. I had very pleasant experience with Airtable for several quite different tasks. This is something you really need to consider before writing your own automatizations.

https://github.com/nocodb/nocodb

#js #vue

​​Flix: Next-generation reliable, safe, concise, and functional-first programming language.

Flix is inspired by OCaml and Haskell with ideas from Rust and Scala. Flix looks like Scala, but its type system is based on Hindley-Milner. Two unique features of Flix are its polymorphic effect system and its support for first-class Datalog constraints.

Flix aims to offer a unique combination of features that no other programming language offers, including: algebraic data types and pattern matching (like Haskell, OCaml), extensible records (like Elm), type classes (like #haskell, #rust), higher-kinded types (like Haskell), local type inference (like Haskell, OCaml), channel and process-based concurrency (like #go), a polymorphic effect system (unique feature), first-class Datalog constraints (unique feature), and compilation to JVM bytecode (like #scala).

https://flix.dev/

Personal opinion: it has all the features new modern programming language should have. It has nice syntax, powerful ideas, and (hopefully) good JVM integration and code-reuse. That's a recipe for a success. I will keep an eye on this amazing language.

It also has a playground on its website, check it out!
I would love to highlight this example of polymorphic effects:

Textual - a Text User Interface with Rich as the renderer.

Why is it cool?
1. It has an amazing grid layout
2. It is from the same team as Rich, which proved to be amazing
3. It has nice user-facing API (it even has async parts), way better than curses

But, it is still WIP. We need to wait for a little bit.

https://github.com/willmcgugan/textual

#python

I've spent lots of hours fixing npm audit to make our #js CI happy. Most of the times - it was garbage.

I've even disabled it in our projects. It was not adding any value, just wasting our time.
But, we still need to check some dependencies to be secure!

Dan Abramov shares his vision about npm audit problems and potential solutions.

We are back in business! 🎉

Long time without proper updates from us.
A lot of things happened in the meanwhile.

Now, let's talk about the future of this project.

The concept of this channel will be the same: "awesome open-source-relalated links". But, I am going to change some details about it:

1. I am going to value "quality" over "regularity", previously I posted 2 links a day. This is problematic. Sometimes there are a lot of things to share, sometimes I have to search for some extra items. No more! Only things that I really want to share, no schedule
2. I am going to add more personal side to this project. I want to add short summaries to each piece of content I share: why this thing is awesome? what's special about it? what ideas are worth noticing? etc
3. No ads, as always. Except of things that I am personally involved in: like conferences and webinars that we organize

Cheers!

Friendly reminder: you can join our dry-python telegram chat: https://t.me/drypython

We discuss functional programming, different new languages and ideas, typing, and #python! Stop by and chat!

My new article is out! It is all about typeclasses in Python and dry-python/classes.

Today I am explaining what typeclasses are and how to use them. I give examples in 4 very different languages: #rust, #elixir, #haskell, and #python to show that this concept is universal.

I am also showing that this idea is very pythonic by comparing our classes implementation with functools.singledispatch. There are lots of different details!

Check how easy it is to define a typeclass with classes:

from classes import AssociatedType, Supports, typeclass

class Greet(AssociatedType):
    """Special type to represent that some instance can `greet`."""

@typeclass(Greet)
def greet(instance) -> str:
    """No implementation needed."""

@greet.instance(str)
def _greet_str(instance: str) -> str:
    return 'Hello, {0}!'.format(instance)

def greet_and_print(instance: Supports[Greet]) -> None:
    print(greet(instance))

greet_and_print('world')

Check it out!

My new article is out!

This time I want to discuss a pretty useful idea for library authors and their users: there are better ways to test your code!

I give three examples (in #python, but the idea itself applies to almost any language) of how user projects can be self-tested without actually writing any real test cases by the end-user. One is hypothetical about django and two examples are real and working: featuring deal and dry-python/returns.

Short example with deal:

import deal

@deal.pre(lambda a, b: a >= 0 and b >= 0)
@deal.raises(ZeroDivisionError)  # this function can raise if `b=0`, it is ok
def div(a: int, b: int) -> float:
    if a > 50:  # Custom, in real life this would be a bug in our logic:
        raise Exception('Oh no! Bug happened!')
    return a / b

This bug can be automatically found by writing a single line of test code: test_div = deal.cases(div). As easy as it gets!

From this article you will learn:
-How to use property-based testing on the next level
- How a simple decorator @deal.pre(lambda a, b: a >= 0 and b >= 0) can help you to generate hundreds of test cases with almost no effort
- What "Monad laws as values" is all about and how dry-python/returns helps its users to build their own monads

I really like this idea! And I would appreciate your feedback on it.
Link: https://sobolevn.me/2021/02/make-tests-a-part-of-your-app

​​Watch coding videos while you code!

Get a YouTube popout with npx pipcorn [youtube-link]

#js

⚡Breaking news!

Numerical #elixir and Elixir XLA bindings for CPU/GPU/TPU.

https://github.com/elixir-nx/nx

So, after recent cryptography incident (https://github.com/pyca/cryptography/issues/5771) our build-times inside the Alpine-based docker-in-docker CI went from several seconds to ~6 minutes just to install #python dependencies.

This forced me to create our own dind image (https://github.com/wemake-services/wemake-dind/) with everything properly set up: python, rust (required to build `cryptography`), docker-compose, and several #docker quality tools like:
- https://github.com/wemake-services/dump-env which enforces strict .env configuration policies
- https://github.com/wemake-services/docker-image-size-limit which enforces strict image size control

Feel free to use it in your own CI pipelines! Not just for python, but for any docker-in-docker setups that use docker-compose.

wemake-python-styleguide@0.15 is just released!

It is the strictest and most opinionated #python linter ever.
Now with even more rules!

https://github.com/wemake-services/wemake-python-styleguide/releases/tag/0.15.0

Features that I really like in this new release:
- python3.9 official support
- Python gets adding new stuff - we continue to forbid using it, now with relaxed decorator syntax. Only old style is allowed, yeay!
- Unpythonic getters and setters detection: no more get_x and set_x methods!
- Consistent comprehension structure: now all your comprehensions will look the same!
- Configuration option to forbid ignoring some violations inline with noqa, might be really useful for complexity rules!

Check it out!

Even more goodness will land in the future vesions. We have a lot of ideas! Do you want to help with the project development? Drop me a line!

​​⚡ Breaking news!

#ruby 3.0.0 Released!

Ruby 3.0.0 covers those goals by:
- Performance: MJIT
- Concurrency: Ractor and Fiber Scheduler
- Typing (Static Analysis): RBS, TypeProf

https://www.ruby-lang.org/en/news/2020/12/25/ruby-3-0-0-released/

An incremental parsing system for programming tools written in #rust

Tree-sitter is a parser generator tool and an incremental parsing library. It can build a concrete syntax tree for a source file and efficiently update the syntax tree as the source file is edited.

Tree-sitter aims to be:
- General enough to parse any programming language
- Fast enough to parse on every keystroke in a text editor
- Robust enough to provide useful results even in the presence of syntax errors
- Dependency-free so that the runtime library (which is written in pure C) can be embedded in any application

https://github.com/tree-sitter/tree-sitter