dbpokorny

yeah but none of them can beat Rijisa Mineru the foolish Destroyer of Github

I'll add autoclave.js to the anythingbot after getting it into a working state...no one else is going to do it, that's for sure

No, any undergraduate CS major at a top 5 university should be able to do this. It's possible to do this for any programming language. If you need help then it's on p. 161 Theorem 7.2 of Hopcroft and Ullman (1979).

I haven't used it, but second hand I've heard that the Python version of this concept is "virtualenv".

Edit: I probably shouldn't be surprised to learn that second hand information I picked up six years ago at PyCon is out of date...

When you say "C" and "Turing machine" in the same sentence, you should immediately think of how you would go about explaining a proof of, say, the fact that a one tape TM can simulate a k tape TM using C. C is just one of many languages in which you can express the state transition diagram of a TM.

int read(void); void write(int); void left(void); void right(void);

read returns 0 or 1. write only uses the least significant bit.

> You know how it goes: one moment you're reading or driving, the next you're off in a daze, thinking about what you should have for lunch, or running through to-do lists in your head.

There must be a word for this moment, when the primary focus of attention shifts from the near physical environment to thoughts that are "mentally near". I certainly know the subjective experience of what is being described, but I lack the words to express it. It superficially resembles a context switch.

Haha, now we just need the 90 minute ZFC to Scheme compiler (3004) [pdf]

I found this video on Hungarian math education (elementary) fun to watch: https://www.teachingchannel.org/videos/teaching-elementary-m...

> you need hooks from the symbol table back into the tokeniser/parser

not necessary. you can add a bit of information to each identifier token: is this the name of a type or not?

you have to split up one of the parser passes, so if you had a two pass "tokenizer" and "LR parser" compiler now you have a tokenizer pass followed by two LR parser passes. The first LR pass is "last mile tokenization". I guess another word would be a (very short) cascade tokenizer/parser.

The intermediate pass adds a piece of metadata to each token marking it as the name of a type or not (this makes the language actually context free instead of just nearly context free). If you do this, then the second pass doesn't see this as two identifiers at all because it knows which identifiers refer to types and which do not.

It's a different application (computing scope data instead of type data) but I've implemented the basic concept of annotating token data with the result of an intermediate parsing stage here...check out line 318 here:

https://github.com/dbpokorny/autoclave/blob/master/tree.js

> The only time you should actually override __iadd__ is for mutable objects

What would the rationale be for such a rule?

the docs don't mention anything like that https://docs.python.org/2/library/operator.html and I've never heard it before. In Python, neither integers nor strings are mutable and both support the "x += y" syntax.

The __iadd__ method works the same for both mutable and immutable objects AFAIK

What are your thoughts re: adding memory protection to C? (in other words: add a distinction between "pointer bytes" and "raw data bytes" and some rules regarding pointer assignment, arithmetic, and dereferencing that serve to treat the pointer bytes as protected memory of a "3rd space" that sits between kernel space and user space; thereby ensuring that a program can only obtain a pointer to either a stack location (with restrictions) or heap location that points to a byte in an allocated segment of memory?)

> Note the distinction between birthday and birthdate

https://en.wikipedia.org/wiki/Birthday

Question of clarification: is this the same concept as Python's __iadd__? I was not aware that this was a "thing" in programming language design.

http://stackoverflow.com/questions/1047021/overriding-in-pyt...

Sounds fine to me, what changes to a standard tokenizer and parser would you make to carry out your plan?

I'm not saying this is a shining example of brilliant programming, but it is in a semi-working state and something "in a similar style" (that is, a three-pass tokenizer -> LR parser -> LR parser where scope information and other metadata is computed in the second pass and fed into the third) should be able to handle the changes you're talking about.

https://github.com/dbpokorny/autoclave/

> uniquely identified by birthday, gender, and ZIP code

This is not correct; you need to say "full birthday" which includes the year, otherwise the statement is nonsense.

    Redditor, n.: a registered user of the website Reddit

ಠ_ಠ

A wild UC Berkeley CS 61A adventure appears!

https://inst.eecs.berkeley.edu/~cs61a/su13/lab/lab06a/lab06a...

You can stick your pseudocode into the "give" function: https://inst.eecs.berkeley.edu/~cs61a/sp15/lab/lab10/adventu...

I'm not sure it's explicit in the original article, but I tend to agree with the sentiment that it's a lot more fun to learn about interpreters and databases when you're making games rather than corporate infrastructure (although I can't deny that building corporate infrastructure has its moments)

Joel Spolsky talks about using the compiler to catch errors on p. 68 of "The Best Software Writing I"

https://books.google.com/books?id=vPvhzDqZlaAC&pg=PA68&lpg=P...

1.

> I also need a word about definitions. What do we mean by “more powerful” or “less powerful” languages? In this article, I mean something roughly like this: “the freedom and ability to do whatever you want to do”, seen mainly from the perspective of the human author entering data or code into the system. This roughly aligns with the concept of “expressiveness”, though not perhaps with a formal definition. (More formally, many languages have equivalent expressiveness in that they are all Turing complete, but we still recognize that some are more powerful in that they allow a certain outcome to be produced with fewer words or in multiple ways, with greater freedoms for the author).

I understand that adding

- automatic memory management - exception handling - object oriented facilities (polymorphism, inheritance)

make a language "more powerful" by allowing the programmer to think at a higher level. For me, this means the language gets out of the way and I can focus on the problem at hand, but everyone seems to have a different idea of what "getting out of the way" means and what constitutes the ideal "default toolbox" for a programming language.

For decades it was true that higher level meant more powerful meant a better default toolkit for the developer, but I resonate with the sentiment that a plateau has been reached in terms of designing the basic toolbox a languages makes available for the programmer.

A less powerful language means easier and more readily available tools to parse and manipulate programs written in that language, which leads me to...

2.

> This happened to me recently, and set me off thinking just how ridiculously bad our toolsets are. Why on earth are we treating our highly structured code as a bunch of lines of text? I can't believe that we are still programming like this, it is insane.

With all due respect, JavaScript as implemented in node.js or in Chrome is a brilliant language and is a fine environment for implementing a static code analyzer and transformer. The same is true of Python, Scheme, C, C++, Java, and many other modern programming languages. It takes relatively little code to to implement powerful tools to parse and manipulate source code when relatively few syntactic forms are accepted. See for example my autoclave.js project below.

The one Wikipedia article I come back to again and again is the "Additional Example 1+1" of https://en.wikipedia.org/wiki/LR_parser

3.

There is a parallel between the instruction set architecture (ISA) of a chip and the syntactic forms that a programming language recognizes. One measure of the "size" of a language is the number of productions in the grammar definition. So I think of a "highly expressive" language with a complicated grammar as a "CISC language" and as you say a "less powerful language" as a "RISC language". All other things being equal, it is easier and faster to implement a toolchain for a smaller language than for a larger one. This is why it is (or was, at any rate) reasonable to ask a first-year college student to implement a meta-circular interpreter in Scheme (MIT 6.001). This is not possible for most other languages (and it is certainly not possible in Python).

This project is just one attempt to carve out such a usable "RISC language" as a subset of JavaScript. If you have the time, I'd appreciate your feedback, thoughts, and suggestions. Thanks!

https://github.com/dbpokorny/autoclave

Go to http://www.html5rocks.com/static/demos/evalbox/index.html

type in

    console.log("foo")

and click either button. It has access to the console even from the sandbox. Is there a way to say: I want this iframe to run a script, but don't give the script access to the console?

> Safe Tcl does not attempt to completely prevent annoyance and denial of service attacks. These forms of attack prevent the application or user from temporarily using the computer to perform useful work, for example by consuming all available CPU time or all available screen real estate

So in other words it wouldn't be a good idea to encourage people to post and run demoscene Tcl programs on 4chan. That's the kind of safety and security I'm talking about.

First of all, I didn't mean my FUD remark to be vitriolic.

I disagree that it is more work in total; I don't think you're taking into account the work that will no longer have to be done, namely work spent searching for cross-module bugs introduced when a security proof for one module relies on a condition which cannot be expressed in the underlying language.

I agree that it is a new type of work though.

Edit: easier for the mathematician who wants to prove that system X has security characteristic Y

I think running code from an untrusted source or semi-trusted source is an underdeveloped area that will bear fruit in the future, but I think the gains will be long-term rather than short-term.

Today we live in a world where the source code that runs our advanced industrial society is owned and maintained in secret. And the business climate is highly competitive so a lot of people cut corners in terms of security. This means that instead of actually proving that their systems are secure system designers do something else.

If, instead, all of the source code of an advanced industrial society were maintained in an online library (like github) and anyone could submit a pull request to anything, then systems would have to have some way of protecting themselves from the introduction of exploits (either intentional or accidental).

So I am asking why practical infrastructure for such protection mechanisms (in terms of static analyzers and transformers) has not been built into Python, JavaScript, and C yet in order to see what people think about developing these kinds of language features.

> Because they shackle implementations too much

I disagree on one count, and on the other count I don't understand, so I'm requesting clarification.

First, the current fashion in programming languages is to allow an implementation to do anything (in Python, "import" takes no arguments, neither "require" in node.js)

I think life could, in fact, get easier.

Today applications do not regulate the code they load. It just has to work. Saying that any effort to regulate the source code of loaded extensions amounts to "shackling" is throwing FUD on the whole idea that an application should handle some (not all) of the responsibility for investigating the code it loads and not rely 100% on the underlying implementation.

With respect to your remarks about validation mechanisms, you'll have to explain the claim that this would "increase the implementation's own attack space" because I don't see how that is possible (unless we're talking about two different things: I'm talking about a combination of (A) static verification and (B) static transformations that instrument code with calls to runtime handler for certain sensitive operations (such as accessing a global variable and accessing a member of an object)

As far as the intersection of (innovation in web technology) and (innovation in programming languages) is concerned, I think the focus on performance is like going backwards in time, perhaps to the mid 90s.

I feel like these innovations are being turned into a kind of "social media spectacle" with relatively little discussion of what innovation really means in this context.

For example: I don't understand why Python, JavaScript, Java, Ruby, and so on have not delivered tools that ease the path for those who wish to write applications designed to run code from untrusted sources. I think this would make the web a lot more competitive and overall healthier as an independent institution.

(Yes I understand JavaScript is code from an untrusted source that runs in a sandbox on your computer, the browser client; in this context I'm referring to the ability of a JavaScript web app to load objects (from a JavaScript source code file hosted on ANY domain, in defiance of XSS dogma) which the browser client guarantees does not exceed the bounds of a specified "sandbox" built to spec, a "security envelope" for loading and evaluating code. For example the ability to tell the client, "execute procedure P with arguments A, but kill it if it runs for more than 0.5 seconds of CPU time or allocates more than 500 MB of memory" or "only load this source code as long as the global variables it uses is on this list: ..., the names of properties is uses is on this list: ..., and it refrains from using the following syntactic keywords: ...)

Python put up a warning against its own "restricted execution" a long time ago: https://docs.python.org/2/library/restricted.html

In the age of GitHub, why is there no interest in building infrastructure that allows programmers to define such "security envelopes" for JavaScript, Python, C, and so on and create systems which are composed of mutually distrusting modules which would, I think, simplify reasoning about their security characteristics?

> we developers keep solving problems we would not have without developers

I genuinely don't understand. Do you not consider the organizational problems of society to be worth solving?

I'm surprised that HN hasn't applied some version of the standard critique of Capitalism already. It's practically de rigueur in fashionable intellectual circles. And in this case it's so easy, an amateur like me can make a decent stab at it.

First of all, we enter the text with a remark about "mistakes of ego". One ego mistake is to conflate "life" with some activity that is taken to be "life-defining" or "the meaning of life". This is a Western preoccupation that stems from Christian spiritual angst with respect to the relationship between "good works" and salvation (this is very complex, see https://en.wikipedia.org/wiki/The_Protestant_Ethic_and_the_S... for details and note the differences between the Catholic and Protestant teachings. The psychological implications of the doctrinal differences are far beyond my ability to untangle).

So here this is applied as follows: conflating life with the process of gaining salvation through good works which in a Capitalist society translates into "game playing" a.k.a. using capital to innovate and earn a return on investment.

Of course none of this helps when it comes time to contemplate mortality. It doesn't matter how much you play nor how many times you win, you'll still be stuck with this over-developed existential angst which was the thing that prodded you to work so hard in the first place.

> When you lose a game of chess, you don't go and jump off a bridge, you reset the pieces and do it again.

> It's a game

The game playing, the "reset the pieces", the conflation of life with the game, and the talk of suicide seem to suggest an element unacknowledged in the text, the idea of the cycle of death and rebirth. It may be a coincidence, but I think the attitude of the Buddhists with respect to this cycle may be connected with their attitude toward games vs. the process by which wisdom arises, but who knows?

https://en.wikipedia.org/wiki/List_of_Buddha_games

OK, that's my critique. How did I score?

Pushing hard on moderator tools. In the short term, Reddit should watch its moderators, look for usage patterns, and build systems to reduce moderation effort. In the long term, Reddit should develop artificial moderation (AM).

Reddit is the natural place for the discipline of artificial moderation (using AI / ML to help moderate public forums) to develop. For example, an automated "argument detection" bot could intervene when two participants start going down the warpath, acting like a janitor who pushes two rowdy students apart when they start fighting. Or, a bot could detect when a post consists entirely of one participant insulting another and take appropriate action.

These are difficult problems, but Reddit is sitting on a goldmine of training data in the form of the human-generated moderation logs. Reddit should either hire the talent to develop such systems or partner with those who already have (Google / IBM / ...).

> keeps us within the fences of the neoliberal capitalist paradigm

That's because the original practices and teachings have been adulterated and heavily re-contextualized. The original context is extraordinarily hostile to Communism, Capitalism, progress, pragmatism, goals, modern society, domestic society, the economy, etc...

Pierre Turlur has an excellent criticism of this particular appropriation, "The Dharma is utterly useless" https://www.youtube.com/watch?v=SvmgpyVcYJc