infer VS berry

I think most development occurs on problems that can't be formally modeled anyway. Most developers work on things like, "can you add this feature to the e-commerce site? And can the pop-up be blue?" which isn't really model-able.

But that's not to say that formal methods are useless! We can still prove some interesting aspects of programs -- for example, that every lock that gets acquired later gets released. I think tools like Infer[0] could become common in the coming years.

[0]: https://fbinfer.com/

Using infer, someone else exploited null-dereference checks to introduce simple affine types in C++. Cppcheck also checks for null-dereferences. Unfortunately, that approach means that borrow-counting references have a larger sizeof than non-borrow counting references, so optimizing the count away potentially changes the semantics of a program which introduces a whole new way of writing subtly wrong code.

Meta/Facebook are long time OCaml users, their logo is on the OCaml website. Their static analysis tool and its predecessor are both written in OCaml.

Then this idea that the US government will tell tech companies how to write secure software. Let's get this straight, the private sector, especially big tech is miles ahead of US government in this regard. Microsoft literally invented threat modelling and modern exploit mitigations. Facebook has the best appsec processes pretty much in the whole world, including their own cutting edge code analyzer. AWS uses formal verification everywhere. Meanwhile the US government itself runs mission-critical systems that's almost literally held together by bubble gum and toothpicks. Maybe they could dial down the arrogance a tad, get their own shit together, learn how this cyber stuff is actually done and only then try lecturing everyone else.

Efforts: Dependabot, CodeQL, Coverity, facebook's Infer tool, etc

I notice there isn't fbinfer. It's pretty cool, and is used for this library.

"Move fast, break stuff" is a great approach when you aren't pushing the broken bits to production. Fuck, even Facebook, the big "move fast, break stuff" company, uses tools to detect errors in its continuous integration toolchain. https://fbinfer.com/

TBH, there's a non-zero amount of non-"ivory tower" tools you may have used that are written in functional languages. Say, Pandoc or Shellcheck are written in Haskell; Infer and Flow are written in OCaml. RabbitMQ and Whatsapp are implemented in Erlang (FB Messenger was too, originally; they switched to the C++ servers later). Twitter backend is (or was, at least) written in Scala.

Node.js manages dependencies using package managers like npm (Node Package Manager), yarn, and pnpm. npm comes pre-installed with Node.js and allows you to install and uninstall Node.js packages. It uses a package.json file to keep track of which packages your project depends on. Yarn and Pnpm are alternative package managers that aim to improve on npm in various ways, such as improved performance and better lock file format.

Depending on the stack of the repository you are cloning, you might have to install additional dependencies. For this demo, I'm using my own website, which is a static website built with Astro.js. It which requires to have Node.js installed and Yarn for package manager.

A package manager such as npm, Yarn, or pnpm. A package manager is a tool that helps you manage the dependencies of your project. You can use any of these package managers to install Jest and other packages.

To start off, you'll need Node.js installed on your local system. This ChatGPT API guide will use Yarn to install dependencies in the project, but you're free to use npm or any other package management tool if you wish. Finally, you'll need an OpenAI account for ChatGPT API access.

This package is available in the Node Package Repository and can be easily installed with npm or yarn

Yarn or Npm(This tutorial uses Yarn)

However, the easiest way to install the Snyk CLI for your JavaScript application is to do so using the npm or Yarn global installation since you most likely already have Node.js installed. Ensure you're using Node.js version 12 or later and run the following command to install the Snyk CLI as a global npm package:

Resolving berry to a url... Downloading https://github.com/yarnpkg/berry/raw/master/packages/berry-cli/bin/berry.js... Saving it into /private/tmp/my-app/.yarn/releases/yarn-berry.js... Updating /private/tmp/my-app/.yarnrc... Done!

Installed Yarn package manager.

I think Prolog really shines as an embedded query engine (I know this is old and it's been removed since). It's perfect for declarative configuration, very easy to write powerful queries once you wrap your head around it.

The Yarn constraints plugin also used (Tau) Prolog, although it looks like it's in the process of being replaced with JS, which makes me a bit sad. The reasoning is here: https://github.com/yarnpkg/berry/issues/1276. Seems like the biggest issue is lack of a nice dev environment. I maintain the Trealla Prolog Wasm port (npm package 'trealla') and I hope some day to use it for a VSCode extension or LSP or something to provide a nice dev experience. Performance has also been cited as an issue[1] but Trealla is quite fast and I expect it could easily handle a complex Yarn workspace with tons of facts. If this sounds like something you'd be interested in helping me with, feel free to contact me or make an issue/discussion here: https://github.com/guregu/trealla-js

[1]: https://github.com/yarnpkg/berry/issues/4079#issuecomment-10...