cant VS snyk

That was one of the short examples in Norvig's Python program-design course for Udacity. https://github.com/darius/cant/blob/master/library/regex-gen... (I don't have the Python handy.)

> figure out a way to do upward movement that doesn’t require annoying special casing. If you figure it out, don’t tell me since it means I’ll have to make more levels.

Don't read this, then: https://github.com/darius/cant/blob/master/examples/games/20...

As long as I'm commenting, here are some links to other console Sokobans I thought were fun (listed in the source code to mine). The sed one is nuts -- I had no idea it could do that: https://github.com/darius/cant/blob/master/examples/games/20...

I've done AoC using my own language before. As a task it's at a sweet spot for finding weaknesses in the language/library/implementation: real and varied enough to exercise your system, small chunks of work, lots of code to compare yours to, with fun and competitive juices.

The first time I did it it forced me to fix some major problems. My language would still be a handicap for me in the state it's in (though I did get on the leaderboard a couple times using it).

fwiw: https://github.com/darius/cant (haven't done this year's so far)

I've used my own hobby language Cant before, for a couple reasons: it's meant to be enjoyable to code in (at least for me), and tackling random problems like this is a good way to drive some improvements to it.

Also similar: the 'for' expression in Cant (search for "syntax: for").

Darius Bacon wrote a version of this in https://github.com/darius/cant/blob/master/library/factoring... where the "frontier" of active riders is stored in a hash table rather than a bin heap, which is almost certainly a more efficient approach. But he's not doing the bitmaps.

Thank you!

I dislike style nazis too, e.g. carping when Peter Norvig's code won't pass PEP 8.

I'm just leery of the expected cost in this kind of case. It can go on working for years until some new complication or some change in the ecosystem makes it suddenly create a really weird problem. Or when you want to try moving to a fancy new Python implementation, you find you have this friction. Matter of judgement where some chance of such messes is paid for by what it can do for you. (Of course when it's less "load bearing" the balance shifts.) With https://coverage.readthedocs.io/en/stable/ for example, it used bytecode hacks to do something you couldn't do otherwise, and that's unlikely to mess you up.

I have had old C programs go crazy years later in a really hard to debug way because newer compilers may interpret your code like your ex-wife's divorce lawyer (as Kragen put it, iirc). Back in the day a lot of us thought we had a different kind of relationship with C compilers, and it'd be fine to code to that informal social contract. (Just a loose analogy.)

I'm piddling away at https://github.com/darius/cant these days. (Some of the motivation was feeling too confined by Python, actually.) No Wasm, but I'm happy it exists! I tried to make a system like it 20 years ago (Idel) and gave up too soon.

Agreed. I used a few Rosetta Code problems in https://github.com/darius/cant/tree/master/examples and https://github.com/darius/cant/tree/master/library, but Rosetta is mostly things I don't care about.

Just for fun I tried it on my own toy language that nobody but me uses -- going to the limit in nicheness. E.g. Project Oiler problem #1 -- it's very wrong, but no shame in that.

Snyk CLI was introduced to the World Wide Web and security enthusiasts on October 2, 2015, as v0.0.0-pre-alpha release. In the past eight years, we released Snyk CLI nearly two thousand times — and more than eleven hundred of those releases happened in the last three years. That’s one release every thirty-two hours, signifying our customers’ growing needs as well as the pace at which we operate to meet those needs at an enterprise scale. With increasing demand, the complexity, reach, and impact of our fast-paced code changes increased, too.

There are a number of ways that you can install the Snyk CLI on your machine, ranging from using the available stand-alone executables to using package managers such as Homebrew for macOS and Scoop for Windows.

There's tons of tools to solve each of these problems Snyk for vulnerability scanning, tons of license checker plugins (like we use license-webpack-plugin which generates the license text for everything we distribute and fails a build if a license doesn't have one of our allowlisted licenses.

oh, such companies already exist: For example Snyk

Snyk provides security score and vulnerability count badges, which you can link to the relevant pages, as in these examples:

If you app is dockerized I would recommend adding something like Snyk to make sure your image is safe.

Note: I remind you that we support multiple strategy for vulnerabilities like Sonatype or Snyk.

My name is Adam, and I am a software engineer working at Snyk for the past 2.5 years. Over the past year, I have been leading a few projects that spanned multiple teams. My colleague is a tech lead at Snyk, and he’s been coaching people on how to lead projects effectively for a few years now.

So I'm curious, how are businesses building iOS apps securely? Could a tool like Snyk replace a manual audit, or is it a good idea to have an initial manual audit of our desired environment?

Ideally, software can quickly go from development to production. Continuous deployment and delivery are some processes that make this possible. Continuous deployment means establishing an automated pipeline from development to production while continuous delivery means maintaining the main branch in a deployable state so that a deployment can be requested at any time. Predecos uses these tools. When a commit goes into master, the code is pushed directly to the public environment. Deployment also occurs when a push is made to a development branch enabling local/e2e testing before push to master. In this manner the master branch can be kept clean and ready for deployment most of the time. Problems that surface resulting from changes are visible before reaching master. Additional automated tools are used. Docker images are built for each microservice on commit to a development or master branch, a static code analysis is performed by SonarCloud revealing quality and security problems, Snyk provides vulnerability analysis and CodeClimate provides feedback on code quality while Coveralls provides test coverage. Finally, a CircleCI build is done. Each of these components use badges which give a heads-up display of the health of the system being developed. Incorporating each of these tools into the development process will keep the code on a trajectory of stability. For example, eliminating code smells, security vulnerabilities, and broken tests before merging a pull-request (PR) into master. Using Husky on development machines to ensure that code is well linted and locally tested before it is allowed to be pushed to source-control management (SCM). Applying additional processes such as writing tests around bugs meaning reintroduction of a given bug would cause a test to fail. The automated tools would then require that test to be fixed before push to SCM meaning fewer bugs will be reintroduced. Proper development processes and automation have a strong synergy.