I wonder if we couldn't use clj-kondo like this does in order to do analysis? https://clojurians.slack.com/archives/C06MAR553/p1651775259680219

Heya @corasaurus-hex! I’ve been working on just that, on and off, for a while: https://github.com/cljdoc/cljdoc/issues/543

oooooh

Kinda related is: https://github.com/cljdoc/cljdoc/issues/565

not sure I agree with "Static analysis is safe"

How so? I only meant safe in that it does not load/run namespaces to glean the API.

extremely complicated untrusted input can do some gnarly things

Which we currently do for dynamic analysis.

it's safer than dynamic by a long shot

Ah gotcha. Fair point, I suppose.

https://signal.org/blog/cellebrite-vulnerabilities/

a very funny example of that sort of analysis

the short of it is a forensics toolkit was set up to read signal messages off of phones. signal turned around and used that to exploit their scanners

Interesting! Well we can certainly still isolate static analysis if we need/want to.

I doubt we'd run into issues but it's one of those things where if it's easy not to do it then it's probably a good idea. I wouldn't go to extremes to avoid it given the context

Ya, it is a good point.

I was making good headway when I hit a big of a snag with ClojureScript APIs and macros. Theoretically all Clojure macros are accessible from ClojureScript. In practice we (and codox) on purpose (or by chance) only see macros that have been explicitly loaded during cljs analysis by the library. I need to explore/understand ClojureScript and macros and public APIs a bit more.

ahhh interesting

that's a neat learning opportunity

Hope so! Jotted some notes https://github.com/borkdude/api-diff/issues/19#issuecomment-1107520705.

god this is just so funny, from that post

> In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software. Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. There is no other significance to these files.

cheeky!