Comment by lloeki | Hacker News Reader

Comment by lloeki | Hacker News Reader

Parent Full thread

> it only provided runtime type checking

That's the big nail in the coffin. Except for RBS and Steep, I don't know of any that does/did static type checking.

And yup, Sorbet's static type check is very partial to the point they recommend enabling runtime type checking.

Also in its usage, Sorbet needs to _evaluate_ files. Too bad if one of them was a script that included `FileUtils.rm_rf`. Ok I'm going overboard (maybe?), but Sorbet is not stable in face of code that has side effects when the file contents is evaluated.

> Also in its usage, Sorbet needs to _evaluate_ files.

Are you saying this in the context of static analysis or runtime analysis? I’m pretty sure Sorbet does not need to eval files for static analysis.

> Ok I'm going overboard (maybe?)

You are going overboard. I like both TS and Sorbet. Neither type system will protect you from running malicious code on your computer.

This:

  cat > foo.rb <<'EOF'
  module Foo
    File.open('oops', 'wb') { |f| f << "hello\n" }
  end
  EOF
  
  srb rbi init
  
  ls -1 oops # => oops

It's not even about malicious code, it's about blanket eval'ing a whole tree of rb files, which may contain anything from mistakes to legit but side-effectful code.

Neither of those have such side effects:

  rbs prototype rb foo.rb
  rbs prototype rbi foo.rb
  typeprof foo.rb

Reply on news.ycombinator.com