So how can ML on source code help us? It's related to doing natural language processing and data mining. #VelocityConf
Starts with all the data on Github, but you still need more. We need to retrieve all that data from archives, then we need to classify and parse, in order to extract metadata.
Goal: answer questions like "what are the names of the functions I altered last month?" #VelocityConf
We need levels of abstraction to deal with source code than individual characters -- tokens, ASTs, control flow graphs, etc. [ed: and this is taking me back to compilers class...] #VelocityConf
[ed: being mildly sarcastic and ribbing @francesc because I know he'll take it well: and we apply some ML neural network pixie dust to it, which there isn't time to explain...]
and we can do things like predict the next tokens, or handle sequences with RNNs #VelocityConf
So can we generate code with RNNs? [ed: okay, now I'm seeing where this is going]
Sure, we can generate
if err != nil {
return nil
} #VelocityConf
but we can also detect errors in source code (e.g. use of the wrong variable/missing variable).
Lots of research to be done. [ed: wish there were more concrete results/benefits to show] #VelocityConf
Look for the unexpected/"interesting" and call attention to it for code reviews. including things you wouldn't catch with static analysis.
Goal: assist code review. @francesc remembers getting great code reviews from the Go team at Google, assisted by tooling! #VelocityConf
Bug prediction, automated code review, automated style guide enforcement, education, and eventually code generation and automatic documentation. [fin] #velocityconf
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Final talk I'll be getting to at #VelocityConf before I dash to Toronto: @IanColdwater on improving container security on k8s.
@IanColdwater She focuses on hardening her employer's cloud container infrastructure, including doing work on k8s.
She also was an ethical hacker before she went into DevOps and DevSecOps. #VelocityConf
She travels around doing competitive hacking with CTFs. It's important to think like an attacker rather than assuming good intents and nice user personas that use our features in the way the devs intended things to be used. #VelocityConf
My colleague @sethvargo on microservice security at #VelocityConf: traditionally we've thought of traditional security as all-or-nothing -- that you put the biggest possible padlock on your perimeter, and you have a secure zone and untrusted zone.
@sethvargo We know that monoliths don't actually work, so we're moving towards microservices. But how does this change your security model?
You might have a loadbalancer that has software-defined rules. And you have a variety of compartmentalized networks. #VelocityConf
You might also be communicating with managed services such as Cloud SQL that are outside of your security perimeter.
You no longer have one resource, firewall, loadbalancer, and security team. You have many. Including "Chris." #VelocityConf
The problems we're solving: (1) why are monoliths harder to migrate? (2) Should you? (3) How do I start? (4) Best practices #VelocityConf
.@krisnova is a Gaypher (gay gopher), is a k8s maintainer, and is involved in two k8s SIGs (cluster lifecycle & aws, but she likes all the clouds. depending upon the day). And she did SRE before becoming a Dev Advocate! #VelocityConf
"just collect data and figure out later how you'll use it" doesn't work any more. #VelocityConf
We used to be optimistic before we ruined everything.
Mozilla also used to not collect data, and only had data on number of downloads, but its market share went down because they weren't measuring user satisfaction and actual usage. #VelocityConf