3 ms·

The name "Semantic Grep" does not give a good idea for what this tool is and what it does. The web page states: "Static analysis at ludicrous speed. Find bug

The name "Semantic Grep" does not give a good idea for what this tool is and what it does. The web page states: "Static analysis at ludicrous speed. Find bugs and enforce code standards" "grep" is short for "global regular expression print". It finds matches for the given regular expression and prints them. "Semantic Grep" is a static analyzer with configurable rules, style checks, etc. It does much more than search and print. Perhaps a better name is needed? Edit: How about "omnilint" or "omnicritic" since semgrep is more of a "lint" (https://en.wikipedia.org/wiki/Lint_(software) https://en.wikipedia.org/wiki/Lint_(software)) or "critic" (https://en.wikipedia.org/wiki/Perl::Critic https://en.wikipedia.org/wiki/Perl::Critic) type of tool that handles multiple languages? Edit2: "Static analysis at ludicrous speed" ==> "turbolint"? ("ludicrous speed" reminds of the hilarious Space Balls scene :) "turbolint, GO!"

petters 6y ago
The literal meaning of "grep" is not the only meaning. It also means “find snippet in files.”
- thesuperbigfrog 6y ago
  Yes. But at least to me, semgrep looks a lot more like "lint" than "grep".
  - prepend 6y ago
    You have to find stuff before you lint it.
smithza 6y ago
There is the common, if informal, definition that grep means "command line text search tool". I read this as "semantic/syntax search tool".
- thesuperbigfrog 6y ago
  But semgrep is much closer to a linter / critic program than a grep program.
deleted 6y ago
[deleted]
alpaca128 6y ago
I clicked on this thinking it's a grep that can search code snippets based on language-aware syntax matching instead of regular expressions. Agreed, this project name is misleading about what it does. The name "grep" always indicated some kind of "find a text/pattern and print results to stdout" utility. Like pgrep, which searches running processes by name and then prints their IDs.
- underyx 6y ago
  > it's a grep that can search code snippets based on language-aware syntax matching instead of regular expressions. Hey, I'm a maintainer of Semgrep, and this sounds like a pretty good description of what the CLI can do, see this example for finding all function/class/method calls: $ semgrep -e '$NAME(...)' -l python flask_todomvc/extensions.py 4:db = SQLAlchemy() ------------------------------------------------------------ 5:security = Security() flask_todomvc/factory.py 15: app = Flask(__name__) ------------------------------------------------------------ 17: app.config.from_object(settings) ------------------------------------------------------------ 18: app.config.from_envvar('TODO_SETTINGS', silent=True)
  - alpaca128 6y ago
    Oh, that's great to see. The website's presentation made a different impression with its "enforce code standards" angle. Looks like a pretty useful tool with a couple nice options. A bit strange that the `-e` option is only explained on the website, but to be fair it seems to be a lot to cover. Still, a kind of "cheat sheet" style summary in the help message would be fantastic, just as a little suggestion.
  - shuringai 6y ago
    question, you mention "no more AST parsing" as a selling line for semgrep. Isn't this actually a bad thing for a staric analyzer, as ASTs are actually... abstract, and closer to the real logic of what the code does? I know analyzing text is faster but is it worth?
    - 6y ago
solumos 6y ago
I think the name's just fine. It searches through your code in a way that you can define semantically/with more context. All of the alternatives you mention carry less meaning, and are less memorable. This is like saying that PubNub is a bad name because it does messaging, and has little to do with pub-sub. Or hell, even that Y Combinator should be called something like StartupFactory since it's not really a recursive tool. In short, the metaphor's close enough.

petters 6y ago

The literal meaning of "grep" is not the only meaning. It also means “find snippet in files.”

thesuperbigfrog 6y ago
Yes. But at least to me, semgrep looks a lot more like "lint" than "grep".
- prepend 6y ago
  You have to find stuff before you lint it.

smithza 6y ago

There is the common, if informal, definition that grep means "command line text search tool". I read this as "semantic/syntax search tool".

thesuperbigfrog 6y ago
But semgrep is much closer to a linter / critic program than a grep program.

deleted 6y ago

[deleted]

alpaca128 6y ago

I clicked on this thinking it's a grep that can search code snippets based on language-aware syntax matching instead of regular expressions. Agreed, this project name is misleading about what it does. The name "grep" always indicated some kind of "find a text/pattern and print results to stdout" utility. Like pgrep, which searches running processes by name and then prints their IDs.

underyx 6y ago
> it's a grep that can search code snippets based on language-aware syntax matching instead of regular expressions. Hey, I'm a maintainer of Semgrep, and this sounds like a pretty good description of what the CLI can do, see this example for finding all function/class/method calls: $ semgrep -e '$NAME(...)' -l python flask_todomvc/extensions.py 4:db = SQLAlchemy() ------------------------------------------------------------ 5:security = Security() flask_todomvc/factory.py 15: app = Flask(__name__) ------------------------------------------------------------ 17: app.config.from_object(settings) ------------------------------------------------------------ 18: app.config.from_envvar('TODO_SETTINGS', silent=True)
- alpaca128 6y ago
  Oh, that's great to see. The website's presentation made a different impression with its "enforce code standards" angle. Looks like a pretty useful tool with a couple nice options. A bit strange that the `-e` option is only explained on the website, but to be fair it seems to be a lot to cover. Still, a kind of "cheat sheet" style summary in the help message would be fantastic, just as a little suggestion.
- shuringai 6y ago
  question, you mention "no more AST parsing" as a selling line for semgrep. Isn't this actually a bad thing for a staric analyzer, as ASTs are actually... abstract, and closer to the real logic of what the code does? I know analyzing text is faster but is it worth?
  - 6y ago

solumos 6y ago

I think the name's just fine. It searches through your code in a way that you can define semantically/with more context. All of the alternatives you mention carry less meaning, and are less memorable. This is like saying that PubNub is a bad name because it does messaging, and has little to do with pub-sub. Or hell, even that Y Combinator should be called something like StartupFactory since it's not really a recursive tool. In short, the metaphor's close enough.