sinancepel

4 ms·

1.
by sinancepel 6y ago
The reasons turn out to be decently boring here. Zoncolan [0] and Pyre [1], which Pysa shares core libraries with, are also written in OCaml, and the language made sense to use from the perspective of both sharing code and having people who
2.
by sinancepel 6y ago
The article briefly mentions this, although it might not be super clear from the short description - "We regularly review issues reported through other avenues, such as our bug bounty program, to ensure that we correct any false negati
3.
by sinancepel 6y ago
Pyre & Pysa try to do a best-effort analysis of Python 2, and supports Python 2 style taint annotations, but most of the code we analyze at Facebook is Python 3.6+.
4.
by sinancepel 6y ago
For Instagram (millions of LOC), the analysis gives feedback to engineers in about 65 minutes on average - note that this is in the context of a diff run: We compare the results of a run on the base revision to the proposed changes, running
5.
by sinancepel 6y ago
Pysa will try to analyze all functions regardless of whether they have type hints, but it work better if the function under consideration is typed. Namely, without type hints, it won't be able to pick up on tainted method calls or attr
6.
by sinancepel 6y ago
1. Pysa should work without watchman - it shares some code and infrastructure with Pyre, but doesn't need Watchman to complete its analysis. 2. Hopefully the answer to (1) helps here. Pysa shares some code with Pyre, including the par
7.
by sinancepel 6y ago
One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
8.
by sinancepel 8y ago
If you're interested in the details of how pyre handles generics, unions, etc., you can take a look at the end-to-end typechecking tests, which provide lots of examples: https://github.com/facebook/pyre-check/
9.
by sinancepel 8y ago
You can have multi-threaded OCaml (our server actually has two threads), but only one can run at a time currently. We solve this problem by having a multi-process architecture where workers only communicate through a lock-free hash table in
10.
by sinancepel 8y ago
If you're having trouble with pip, I'd recommend trying `pip3.6 install pyre-check`.
11.
by sinancepel 8y ago
Yes! Pyre adopts types from the typing module, and relies on typeshed[1] to infer types for standard library functions. [1]: https://github.com/python/typeshed
12.
by sinancepel 8y ago
Exactly - the LSP portion of pyre works for files you have open in an editor, but might miss changes due to a rebase or files you edit on the terminal. The watchman integration is there to make sure that pyre's aware of changes outside