Hacker News new | ask | show | jobs
by dfabulich 2632 days ago
One piece of feedback: I've often wished to work on static analysis tools, but too much of the work in this area is focused on Haskell or Lisp. (All of the code in this article is in Haskell or Lisp.)

Does any of this stuff work on Java, Python, or JavaScript? I want to improve the quality of real-world programs written in industry-standard languages.

This "gentle introduction" makes it seem like the first step of the process is "port your app to a homoiconic language," -- or, in other words, "you can prove the correctness of any language you want, as long as it's Haskell or Lisp."
2 comments
nickpsecurity 2632 days ago
https://en.wikipedia.org/wiki/List_of_tools_for_static_code_...
link
dfabulich 2632 days ago
That's static analysis, but not symbolic execution. Looking at the JavaScript section, you can't do any of the stuff described in the article with JSLint.
link
tluyben2 2632 days ago
Abstract interpretation is a wider concept than symbolic execution; check the post in the top thread answered by user mjn to get more info; the fb and mozilla ones seem to focus on more mainstream languages.
link
nickpsecurity 2632 days ago
The parent said "static analysis" tools. That's what I gave them.
link
sophiebits 2632 days ago
Prepack is an example of a (not production ready) tool to do abstract evaluation of JS.
link