Implementing a security typed variant of Scala - which method is best? - scala

Hio there Scala folks, I'm actually writing my master thesis and I have to implement a security typed language in Scala. So this means I have to add annotations to specify the special permissions levels for the variables and other programming constructs in Scala. The idea to add this comes from Jif (a real security typed language http://www.cs.cornell.edu/jif/) and FlowCaml (http://www.normalesup.org/~simonet/soft/flowcaml/). I still have to check how this languages add their security extensions.
I talked to my advisor and he suggested three possibilities how I can implement this feature in Scala:
source-to-source compiler (I don't think this is the best solution to write the things from the scratch because I will be busy with the parser and semantic and out of own experience I know that I don't have quite enough time to work on the main stuff)
type-checker plugin (I haven't wrote a plugin for compiler and think this just won't work on further versions of Scala because the compiler is still under development)
build a library in Scala (syntax are here simply free, so I can easily build something like this in a language I want => think this is like inventing a DSL and I believe that this is the best solution)
If you have another idea how to implement please let me know and if you have pros and cons for the methods mentioned above please let me know. I'm convinced that I will learn after this project of to program with pleasure in Scala (I'm familiar with Java and Ruby).
Greetings
Matthias Guenther

This is definitely a job for a compiler plugin: writing a plugin which allows annotations to further refine the possible subtype relationships is fairly straightforward, at least in simple cases.
You can be reasonably confident that the compiler plugin API will remain stable for the lifetime of a masters thesis, and you should investigate scala.tools.nsc.symtab.AnnotationCheckers and google for example plugins which implement compile time checks for (non-)nullability (ie. T #NonNull <: T, but not T <: T#NonNull) which is structurally similar to the simplest non-trivial security typed scheme.

Wow, this is quite a sizable project!
I think the answer to your question depends on if you're looking for a sound language addition or if you just want something that may be circumvented by the programmer but still might be helpful. Since you mention Jif and FlowCaml I assume you want to go the sound way and provide guarantees for your language. Then I don't think there is much option but create your own language constructs on top of Scala and provide a new frontend for those.
I very much doubt that you can implement security as a library in the style of Peng Li and Steve Zdancewic or Alejandro Russo. The reason is that Scala can have side-effects everywhere and that pretty much ruins any security guarantees that you can try to enforce.
Good luck!

Related

ReasonML vs Scala.js

So by reading the reasons why facebook choose OCaml to create Reason, I couldn't stop noting that Scala met all the requirements too.
I'm not biased whatsoever, I know Scala, but I'm not a die hard scala advocate. I just like a nice type system, so in this point I'm finding really hard to choose between those two for my next project. So what are the real trade offs here?
Reason react can do per file compilation so it’s easy to slip into an existing project. Scala.js allows you to tap into scala libs and the scala ecosystem. If you only focus on web it’s probably best to stick with what Facebook offers. I have computations that i do and for that Scala and non-ocaml tools are more helpful. Since you already know scala, you can use the reason-react model by using a library I put together at https://github.com/aappddeevv/scalajs-react.

Socket.io Scala client

I'm looking for a socket.io client for Scala. I'm well aware of this, but I cringe at the idea of using it in Scala as it wouldn't feel quite natural nor would it allow for an idiomatic implementation. Does any of you, thus, have a suggestion as to where could I find a Scala client?
If so, just the lines for SBT and a link to the doc will suffice as an answer ;)
I'm afraid I don't know any already implemented libraries or apparent solutions for Scala. But I'll present two very simple approaches that should be very easy to use if you have the time to DIY :-)
But of course it really depends on what you want. As you probably already could imagine a plain WebSocket implementation of Java's standard library can be quite efficient if you need to process simple requests. I found one at scala-lang.org implementing a server calculating random numbers. If it is of interest there's also something brewing at the nightly build which might reveal some handy tricks.
If you want to go for simplicity and for pure Scala in all its might the Actors (in particular a RemoteActor) are immensly powerful. It requires Scala on both ends naturally, but it gives you a messaging-system almost instantly. This is a pretty good start-guide if you aren't already familiar with them.
Anyway. If no good library surfaces I hope this helped. Good luck.

Scala for Junior Programmers?

we are considering Scala for a new Project within our company. We have some Junior Programmers with only PHP knowledge, and we are in doubt that they can handle Scala. What are your opinions? Some say: "Scala is a complicated beast!", some say: "It's easy once you got it." Maybe someone has real-world experience?
"My coworkers will not understand Scala" is simultaneously overstating its difficulty and insulting your coworkers.
Scala is not that difficult. It's just another programming language. Any trouble that junior programmers have with Scala is going to be more or less the same trouble they would have with any other language.
Your coworkers are smart. Of course, I don't know them, but it's a pretty safe bet unless your company is the kind of organisation that hires stupid people, in which case, you have bigger problems.
That said, at my company we have some core products developed in Scala, and we don't find that people have any more trouble with it than Java. The code is generally more clear and concise, easier to generalise and reuse, etc.
I guess Scala could be used as a "beginners" language. Even though there are tricky ideas behind it, you dont have to use/explain them in the beginning. If you explain pure OO with Scala, I would say it is straight forward and easily understandable. As Scala reduces a lot of code overhead from other languages it might even be easier to learn concepts with Scala than with Java/C++.
A major drawback I see with Scala as a beginner language is the lack of documentation. Don't get this wrong, the official Scala doc is very good and also the few books that are available are quite useful to get the details of the language, but those have not been written for beginners. For example in Java you find hundreds of books titled something like "Learning OO with Java" you wont find that for Scala which may be a show stopper.
As Hannes mentioned, only do new language introductions within research projects and not productive or even flagship projects. If you have some juniors, that makes the situation even better, take some internal tool, you always wanted and needed and let them create it during a research project. This is also a nice opportunity to experiment with different development-processes. And your juniors most probably like to be challenged and will deliver a good prototype and a very well proofed opinion if Scala can be used as a beginner language.
I believe that most people moving to Scala are experienced and enthusiastic coders. I'd suggest that you get in-house experience with a Scala project with your senior programmers first before forming a strategy for mentoring your junior coders. I'd also suggest that you only involve people who are eager to join in.
I would advocate it. But with the proviso that you have clear guidelines on what language features are acceptable for your team. For example, coding primarily in an imperative style (which is familiar for Java-trained people), or perhaps limiting the employment of recursion or closures.
Also plan for seniors to mentor the juniors. This may take the form of any combination of: pair programming, code reviews, info sessions, regular discussion forums, etc.
The opportunity that scala presents for vastly improved coding on the JVM is too great to pass up. When your seniors get into it I would not be surprised if they find renewed passion for development. When your juniors get into it they will be learning best practice JVM development from the start.
If you choose to go this route, perhaps they'll find easier to use the Scalate framework than a more traditional one like Lift, since it allows mixing HTML with Scala, much in the same way as PHP works.
Scala is a very 'normal' programming language. Any programmer should be able to learn this language. The people that have difficulties learning Scala mostly are experienced with imperative languages and are surprised by the functional concepts. So unexperienced programmers may learn it even faster. In my opinion should be no problem, to assign it to juniors. From a management point of view, I would assign a junior and a senior developer as a team (or more of both, depending on the size of the project).
I think it depends whats more importent for you. If you want to learn as possible about OO Programming and the standard stuff its a bad idea.
But what you really give them is a opportunity to learn something really cool and unique. Witch can be good motivation. Scala has many cool stuff in it. If you can handle Scala you can handle a lot of otherstuff as well.
Talk to the Programmers (all of them) and tell them why you wanne to use scala. Ask if the have to motivation to make and learn something not everybody can do and go the extra mile?
If the are go with it!
My initial thought would be that Scala will be too heavy for them but then I guess because Scala is an OO/Imperitave/Functional hybrid, one could introduce them to the OO/Imperative part of scala until their comfortable, but then again they will probably have bad PHP habits in Scala since scala authors mostly prefer the functional style over the imperative one.
So, it could work, but I would do it for a research project, and definately not for a flagship one.
Edit: Perhaps this should be said also: It seems that functional/OO hybrids like Scala is becoming more popular especially because of how functional languages handles parallel processing as opposed to how we know it in languages like in Java. The amount of cores found in a chip is increasing rapidly, so this is important. However, mentioning PHP, it seems that you are developing web server scripts where threading is less important. PHP doesn't even have threads.
This raises another point. Do you want to develop Scala Web applications i.e. Lift. If so then you have a doubled up learning curve which should also be considered.
Imagine that you would have picked Java and asked whether they could handle Java. If your answer is they could, then they can probably handle Scala.
Scala is only marginally more difficult due to:
No great IDE support. The support ranges from poor to good. Not necessarily an issue for a PHP programmer.
Documentation not as rich as Java
Both Java and Scala have new challenges for a PHP programmer (JVM, new libraries, compiled language, statically typed).
I don't think Scala is a complicated beast, but you do need to understand some of the syntactic sugar and design principles, which would be true of learning Java as well.
Yes, if...
Strategic decision has been made to go with Scala
Company can handle the hit (financial and time) that will come from the steep learning curve.
No, if...
No senior Java, C# or C++ programmers can be put on the project too
Can't find a Scala programmer to act as a lead
Programmers don't have the patience to learn Scala or deal with a language where Jars (libraries) are scattered all over the place, rather than in one or two neat packages like PHP.
*Note: if the junior programmers were C++, C#, or Java Software Engineers rather than PHP, then my answer would be different like, Go for it!
I would not recommend it. My experience of Scala is only from homebrew projects, but I would imagine the currently lousy IDE support, quite frequent API changes and a very flexible syntax (that allows one to hang himself and everybody else participating in the project) would cause a lot of problems in a bigger, more official project.
Give them IntelliJ and throw 'em in the deep end.
Here is a blog post I recently stumbled upon:
http://james-iry.blogspot.com/2008/07/java-is-too-academic.html
It shows that even Java can be too academic to be understood by programmers which have no experience in functional programming. On the other hand, Scala allows to write code the "imperative way", so you can avoid all the FP stuff if you do not understand it. In my opinion, Scala is much more concise than Java, so I guess a "junior programmer" should be able to handle it.

Stuck with JVM, Sick of Java... Where to go? [closed]

Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 1 year ago.
Improve this question
For the next 3 years I will have to work with the JVM (project requirement) using a very specific third party API. They want Java but I've been given leeway to move away from Java. I was hoping we could move back to the .NET framework so I could develop code in F#, being absolutely in love with OCaml. .NET development has been struck down by our customer. It is a no go.
I've turned to looking, reading, and poking around programming blogs/forums trying to understand which language might appeal to me further: Scala or Clojure. Those seem to have the largest community/fan base. Being experienced with ML languages I see lots of people who compare Scala to ML. However, there are some real naysayers when making this comparison. If Scala was that close to ML my productivity and learning curve would benefit making this switch.
The internet is full of misinformation and wonder if I'm suffering from such. I don't like the syntax of Lisp (don't hurt me!) but if Scala has the warts I'm reading (poor IDE support, in flux Unit testing framework, performance issues) I'm wondering if Clojure is the better option. I want to be productive out of the gate, using functions as first class objects, and minimizing concurrency pain.
So anyways, before I spend too much time on the internet and not working... I'm stuck with the JVM, sick of Java and wondering where to go?
In my opinion, both Clojure and Scala don't have great IDE support, if that's really important to you. That said, here's what I can collect from my reading & experience.
Scala's pros
Faster than Clojure thanks to more static typing
Closer to ML (syntax, type-directed programming)
Bigger standard API (Clojure's APIs grow very slowly, because they want to make sure they find the best idioms before making them public. That said, Clojure still has semi-official supplementary APIs)
Better integration practices with the typical Java toolset (Clojure is still making some choices, so less firmly established yet on this regard)
Older than Clojure (but Clojure is built on top of a very old and proven core: Lisp)
People say it has chances to reach mainstream, while they wouldn't say the same about Clojure
Clojure's pros
Incredibly easy, fast and right concurrency thanks to MVCC-based STM and other concurrency mechanisms
Immutability by default helps doing the right thing first
More stable standard API
When things change, usually you don't have to rewrite any existing code
(Scala's collections are being remade again for 2.8)
(I have also read somewhere that it's common knowledge that Scala's Actors implementation needs a rethinking and rewrite.)
Easier to learn (small language, being a (very-clean) Lisp)
An opportunity for you to grow by learning something different
Clojure's performance will only get better with time; there's still room for nice optimizations in the compiler
Scala's tying to Java feels more limiting than Clojure's (interactions between Scala's and Java's static type systems). One could sometimes say the same about Clojure (Object-Orientation's support is not a 1:1 fit, but support for this will soon get better)
Rich Hickey has a gift for making choices that put Clojure in the position of having technical leading features that will be adopted by other languages in the decades to follow. And he also has a gift for explaining them. So use them today in Clojure, or wait to use them in another language in some number of years. :)
On distributed concurrency
If your concurrency needs are distributed, Clojure doesn't yet have anything for this unless you run it on top of Terracotta or something similar, in which case you'll be able to use all its concurrency features. If you do, you will end up with a better distributed concurrency experience than with Scala's Actors, IMO.
Conclusion
IMO Scala tries to do everything, and succeeds at doing most of it. Clojure doesn't try the same thing, but what it focuses on is more than enough and succeeds so well that most people really knowing Clojure wouldn't want to go back to something else. Disclosure: my personal preference goes, of course, to Clojure. I hope I've been able to be objective in what I wrote.
Have you considered Groovy? I don't think it is quite as functional as Scala/Clojure, but it's certainly a lot more functional than Java**. In general, I can get the same work done in Groovy with about 50% of the code it would take me in Java.
This is because Groovy is syntactically similar to Java and provides seamless access to the JDK libraries, but the addition of a lot of language features (closures, meta-programming, properties) and dynamic typing eliminates almost all the boilerplate associated with Java programming.
** I mean functional in the sense of 'functional programming' rather than 'working correctly'
I'll address the points you raised about Scala.
IDE support:
Scala doesn't have the same level or IDE support Java has -- or, for that matter, that F# should have with VS10.
That said, it has one of the best (maybe even the best?) IDE supports on JVM, outside Java. Right now NetBeans is good enough, and people have consistently said IDEA is still better (hearsay). The Eclipse plugin is unstable though.
But you mentioned a 3-years range, and the IDE support for Scala should be greatly enhanced once Scala 2.8 is out, as it will provide some compiler-support for IDEs. There's no release date defined, but it looks to be within the next six months, maybe three. And the Eclipse plugin will be updated right along with it.
In flux unit testing framework:
Yes, if you meant it is vibrant, evolving and well supported, instead of stagnant and abandoned. ScalaTest, Specs and ScalaCheck are top quality frameworks, compatible between themselves, and compatible with other Java frameworks and libraries, such as JUnit and JMock.
The testing frameworks, in fact, are almost a child poster of what is possible with Scala.
EDIT: Scala has basic unit test support in its standard library (scala.testing.SUnit). However, given that many superior, actively-supported and free alternatives have appeared, this has been deprecated and will likely not be part of the library shipped with Scala 2.8.
Performance issues:
I'm unaware of any, aside from the fact that you can write lousy code, just as with any other language. People not used to functional programming will often do stuff that's not efficient, such as not using tail recursion, or concatenating lists, and the paradigm shift that Scala enables brings that to light.
At any rate, you can write Scala code as fast as Java code (even faster with some upcoming features). And you can write Scala code with functional features almost as fast as Java code.
Quite frankly, get another job.
If you are to spend the next three years feeling uncomfortable on what you're doing, you should consider looking for more attractive alternatives.
Even if you manage to get a language you like, if you are part of a team ( which I guess you are ) the rest of the team might not like that language. If the rest of them code in Java and you in "fill in the blank" programming language, then problems may arise.
It is not that bad after all.
Talk with your boss, let him know how do you feel. Start looking for alternatives and have a nice and professional "leave".
There is no reason why you can't still have a good relationship with your current boss. If eventually they have a new project for .net you may come back. Talk about that also with them. Leave your doors open.
Its not really a zero sum game, learn them all!
ps: i vote for Clojure, i find it the most fun!
You should consider yourself lucky that you can use the JVM, because the JVM is becoming more and more popular for alternative programming languages than Java.
Besides Java there's Groovy, Scala, Clojure (a Lisp dialect on the JVM), JRuby (Ruby on the JVM), Jython (Python on the JVM), Jaskell (Haskell on the JVM), Fan (runs on the JVM as well as the .NET CLR) and lots more, and there's also an OCaml-Java, OCaml that runs on the JVM.
So, there's lots of choice in programming languages on the JVM, from purely functional to simple scripting and anvanced OO languages.
Tool support for Scala and Clojure may be immature, but it's steadily improving.
Since you like F#, then Scala is most likely your best bet. I say try it out and form your own opinion - you might find that the things people gripe about are things that don't matter to you, or things you can work around.
Don't forget jRuby, and note that an IDE is optional for non-Java
I think you have a great situation. How many people get permission to choose the implementation language? With everything available for the JVM having your environment chosen is not much of a restriction.
You won't need great IDE support in the less verbose languages
In a language as powerful as Ruby with no type declarations, you don't need an IDE at all
Scala was developed specifically to cure the verbose-java-blues
Count yourself lucky that you have three years of work lined up :-)
Clojure might be fun and provides functional concurrency-safe design patterns
Noop? http://code.google.com/p/noop/ (experimental though)
In terms of IDE support and other doubts you're having, Clojure doesn't do any better than Scala. And for a person with ML/F# background (or generally that in strictly, statically typed FP languages), you'll definitely find Scala much closer to what you're used to.
If you like ML you might like CAL which is more-or-less Haskell 98 for the JVM.
It is high quality and very stable, and has good IDE support on Eclipse, but sadly is no longer under active development.

Any practical coding dojo/kata ideas?

I've been asked to run a workshop and coding dojo soon for people to try out Scala and try to build something with it. The attendees are all going to be new to Scala, and could come from any of a number of languages (I'm presuming they can code in at least one mainstream language - I'm including syntax comparisons with Java, C#, Python and Ruby).
Part of the appeal of Scala is that it's practical - you can use it as a drop-in "power Java" (Java with less syntactical clutter, closures, immutability, FP, traits, singleton objects, nifty XML handling, type inference etc.) that still runs on the JVM (and on the .NET CLR supposedly) and doesn't require you to change build tools, server infrastructure, libraries, IDEs and so on. Most of the katas I've seen have been fun but not 'real world' - mathematical challenges like Project Euler and so on. These don't seem appropriate as we're trying to explore the use of it as a practical, real world language that people could consider using for both hacking and work, and because people aren't necessarily going to be too familiar with either the deeper parts of the Scala syntax or necessarily of the concepts behind functional programming.
So, has anyone come across any more practical, everyday katas rather than arithmetical 'problem solving' ones? Katas, that is, that can test whether the language, libraries and tools can satisfy the use cases of the actual day-to-day programming most people have to do rather than testing out. (Not that the impractical ones aren't fun, but just not appropriate for the kind of thing I've been asked to run.)
If I can't find good examples, I'm thinking that it might be useful to try and build something like a library catalogue - the event is for programmers who primarily work on building infrastructure for universities (and in education and culture - museums, galleries, schools, libraries and so on). It's a bit boring though, but it's the sort of thing that the attendees work on in their day-to-day existence. Any suggestions?
There is a creative commons licensed introductory training course with hands-on exercises here:
http://github.com/javaBin/scala-training-slides
http://github.com/javaBin/scala-training-code
The slides are in Open Office format. If you don't have this installed, you can upload them to SlideShare, which will convert them for online viewing.
Most of the programming examples in my blog are, effectively, coding dojo exercises. Particularly the matrices series, but also the puzzles and 99 beers. Now, don't disregard the matrices series as being "mathematical", because the problems I concern myself in it are related to the construction of classes in Scala, not to doing fancy algorithms. In fact, I pretty much skip over the mathematical algorithms themselves.
Now, 99 Scala Problems and pretty much everything from Project Euler are nice exercises for the functional part of Scala, but I understand that not to be your emphasis. I do recommend retronym's answer. Rosetta Code, not being functionally oriented, might have more general examples. There are many with Scala examples, of course, though you may wish to consider other tasks as well, for ideas.
There's lot of cool things to learn about Scala, but one has to be careful at beginner level. For instance, I would not speak of dependency injection (self types and the cake pattern) or of type classes (the pattern that simulates such with implicits).
Do look as well at the material on the Scala Lang site, particularly the Scala by Example document.
EDIT
I have now overseen several Scala dojos, so here's a bit of stuff I've learned from then:
Problems: they have to be fun, not-quite-easy, not-that-hard, and that has to be everyone's opinion.
We use the Dojo Puzzles site, which is in Portuguese so it won't be of use for most people here. If there's a similar site in English, I'd love to hear about it.
The way it works is you ask for a random problem, look it over and discuss to see if you'll pick it up or not, and then indicate by saying you'll use it, you'll not use it, or maybe you'll use it but you'd like to see another one. This vote gets registered and you can see how many people picked up a problem, which helps deciding whether to pick it up or not in first place.
Scala knowledge: it turns out it's not that important to introduce key concepts of Scala language beforehand, particularly if some of the participants have basic knowledge.
In my experience, setting up the testing environment with a trivial "pass" test and explaining how people should write the tests is often enough to get people started. If you feel someone is struggling to write something, give a quick explanation and get on with it.
Teaching Scala: if you do set out to teach Scala, keep lessons short and follow up with a dojo. In this case, keep a set of dojo problems that are adequate to the lesson, and, depending on how many lessons you want in one day, short.
It helps imposing artificial constraints on how one must solve a problem. Some examples of constraints I have put in practice are no classes and single-expression methods (that is, no multiple statements or val/var declarations). The point of these constraints is making it impossible for people to solve the problem in the way they are used to, which gets them to explore the language in search of alternatives.
I have the final results of three dojos done at my current job in this repository.
At the moment we are using the Randori Kata format, but without fixed time or break, and with retrospective at the end of the dojo, not at the beginning of the next. This, however, is just were we are currently at -- we have experimented many variations, and we are still evolving.
Perhaps you could have a look at the Ruby Quiz material for inspiration.
Take a look at Scala by example from Martin Odersky (creator of scala)