Hacker News Reader

Comment by eric-hu | Hacker News Reader

> Also in its usage, Sorbet needs to _evaluate_ files.

Are you saying this in the context of static analysis or runtime analysis? I’m pretty sure Sorbet does not need to eval files for static analysis.

> Ok I'm going overboard (maybe?)

You are going overboard. I like both TS and Sorbet. Neither type system will protect you from running malicious code on your computer.

View on HN

This:

  cat > foo.rb <<'EOF'
  module Foo
    File.open('oops', 'wb') { |f| f << "hello\n" }
  end
  EOF
  
  srb rbi init
  
  ls -1 oops # => oops

It's not even about malicious code, it's about blanket eval'ing a whole tree of rb files, which may contain anything from mistakes to legit but side-effectful code.

Neither of those have such side effects:

  rbs prototype rb foo.rb
  rbs prototype rbi foo.rb
  typeprof foo.rb

Reply on news.ycombinator.com