pfff

too fast compared to grep. While pattern is cool, it cannot precisely match some syntax nodes. (example, selecting generator expression in Semgrep is very hard). It also does not have API to find code programmatically. I have also a short summary for tool comparison. https://ast-grep.github.io/advanced/tool-comparison.html

worked on a similar project called coala[2] which got all the way up to 78 analyzers covering 54 languages, until the project ground to a halt over the maintenance burden of all that. One of our team members at r2c came up with a novel approach to this problem: he suggested reusing some of his old work on Coccinelle[3] and later Sgrep[4], which were tools to search parsed syntax trees of various languages. Conceptually this meant that while Bento and coala could standardize the command-line interface, the configuration syntax, and file targeting logic of linters, now we could also standardize the core linting logic. Extending Bento with linting rules using this pattern language proved to be so easy that we rather just reimplemented the existing linters with it. And thus, Semgrep was born specifically to scan code with these pattern definitions, and there was no longer a need for Bento. Our rule registry[5] now contains over 1,500 rule definitions in this standardized linter rule definition language, across 20 languages. And this leads us to our web app. Early adopters of Semgrep encountered problems rolling out the CLI tool across their organization. Their key needs: scanning hundreds of repos, reviewing all their scan results, deploying custom organization-internal rules across them, and avoiding backlash from developers during all that. We also made the unorthodox decision to start with a ground rule that we never ever want to have access to the source code of our customers. These needs and rules guided our web app’s feature set, which ended up being: provisioning CI jobs on repositories, centrally configuring which rules should block builds or notify people, sending notifications via PR comments/Slack/email, and displaying the list of all findings, along with some analytics. As for today, we just launched a major release of Semgrep App, which cuts down on the complexity that built up in our original implementation, and we also tried to expand the problem space our app tackles all the way through remediating issues on the web UI. You can read more about these recent changes at https://r2c.dev/blog/2021/semgrep-app-fall-2021-updates/ And as for the future, two main areas of interest are 1) intelligently selecting all the right Semgrep Registry rules for a given project and 2) creating a smooth workflow for organizations to collaboratively maintain their own set of internal Semgrep rules. Please check out the app we built at https://semgrep.dev/products/semgrep-app, and let us know what you think! I’ll be hanging out in the comments as one of the engineers who built the app, but our CEO (ievans) is also ready to answer questions, and the rest of the team will surely be lurking here as well. [0]: https://news.ycombinator.com/item?id=24931985 [1]: https://news.ycombinator.com/item?id=26904951 [2]: https://github.com/coala/coala/ [3]: https://en.wikipedia.org/wiki/Coccinelle_(software) [4]: https://github.com/facebookarchive/pfff/wiki/Sgrep [5]: https://semgrep.dev/r/

tions, but also code in Scala, Racket, Haskell et. al. I am currently working in a huge project with about >30 people working on building an MDD (Model Driven Development) platform for visually/declaratively writing things for the systems we use internally. These will be able to create models out of code and even fix API incompatibilities automatically. [2] Excuse the Unicode, I got bored ⬬══════━━━━━━──⋯𝅖܅܅܅܅﴿⌁⏧⌁﴾܅܅܅܅𝅖⋯──━━━━━━═══════⬬ [0] https://github.com/facebook/pfff [1] http://www.intertech.com/resource/usergroup/Neal_Ford-Buildi... [2] http://vjovanov.github.io/dsldi-summer-school/program.html

ase. 2. Never underestimate value of having a different pair of eyes look at code you have hard time reasoning about. 3. Be in constant search for resources (like books, blogs) available on the code / topic of your interest. You'd learn amazing amount by reading through other people's analysis. Stackoverflow is a great start. Heck, you can even ask well thought-out questions on Quora/Stackoverflow. 4. Hang out on related IRC channels / community mailing lists. For things written in esoteric languages such as OCaml, I found these to be pretty helpful. 5. You could blog about it, share the information you know over email lists, setup wikis; and people who know better would correct you. Its a win-win. Good luck. [0] http://sourcegraph.com/ [1] https://github.com/facebook/pfff [2] https://opengrok.github.io/OpenGrok/ [3] http://www.stack.nl/~dimitri/doxygen/ [4] http://www.oracle.com/technetwork/articles/java/index-jsp-13... [5] http://www.gigamonkeys.com/code-reading/