Upgrade to Pro — share decks privately, control downloads, hide ads and more …

HCI & Static Analysis -- LXJS 2014

HCI & Static Analysis -- LXJS 2014

HCI & Static Analysis with graph theory, npm and friends.

Charlie Robbins

June 27, 2014
Tweet

More Decks by Charlie Robbins

Other Decks in Technology

Transcript

  1. And why should I pay attention? 8IPBSFZPVFYBDUMZ Founder & CEO

    at I’m on the Internet! Now with strong Net Neutrality in Europe! !JOEFY[FSP
  2. Human–computer interaction (HCI) involves the study, planning, design and uses

    of the interaction between people (users) and computers. It is often regarded as the intersection of computer science, behavioral sciences, design, media studies, and several other fields of study.  5&3.1016-"3*;&%*/5)&T
  3. How soon exactly? 8IZJTBXPSUIZ)$*UPQJD "40' OQN    

                       .BWFO                               EBZ EBZ 306()-:#:56&4%": :61
  4. The G = (V,E) kind of graph %FQFOEFODZHSBQIT • Basic

    graph representation is not extremely helpful for visualizing package relationships. • But it does provide a basic structure for a graph search problem.
  5. The G = (V,E) kind of graph %FQFOEFODZHSBQIT • We

    then add a colored edge from any node nA to nB if package A depends on package B. • Edges are colored by dependency type: dependencies or devDependencies • To build our graph, G, we add a node (or vertex) for every package. na nb nc nd
  6. The G = (V,E) kind of graph %FQFOEFODZHSBQIT { "name":

    "package-a", "dependencies": { "package-b": "~1.0.4", "package-c": "~2.1.3" }, "devDependencies": { "package-d": "~3.1.2" }, "main": "./index.js" } na nb nc nd Now imagine this for 80,000+ packages!
  7. Ok, so what is this useful for? %FQFOEFODZHSBQIT • There

    are tons of useful applications of dependency graphs. • Lets consider two. First: Codependencies
  8. Well, technically co(*)dependencies. • Codependencies answer the question “people who

    depend on package A also depend on ...” ["package", "codep", "thru"] $PVDI%# $PEFQFOEFODJFT
  9. The G = (V,E) kind of graph %FQFOEFODZHSBQIT Here we

    would say that package-b and package-c have a codependency relationship thru package-a na nb nc nd { "name": "package-a", "dependencies": { "package-b": "~1.0.4", "package-c": "~2.1.3" }, "devDependencies": { "package-d": "~3.1.2" }, "main": "./index.js" }
  10. Thanks CouchDB! for  (var  dep  in  d)  {    dep

     =  dep.trim();    for  (var  codep  in  d)  {        codep  =  codep.trim();        if  (dep  !==  codep)  {            emit([dep,  codep,  doc._id],  1)        }    } } • We can get all of this from a simple CouchDB view. $PEFQFOEFODJFT
  11. The meat of the analysis • So this is all

    well and good, but what the heck are you doing?!?! For module NAME generate a matrix by: - Rank codependencies based on number of times they appear - For each codependency C in the SET of the top N: Rank SET - {C} by number of times they appear to create ROW[C] $PEFQFOEFODJFT
  12. Understanding codependencies through winston $PEFQFOEFODJFT • This last step yields

    a matrix for the codependency relationship: ┌───────┬───────────┬──────────┬──────────┬──────────┬───────────┐ │ │ asyn… │ expr… │ opti… │ requ… │ unde… │ ├───────┼───────────┼──────────┼──────────┼──────────┼───────────┤ │ asyn… │ 0.0000 │ 553.0000 │ 534.0000 │ 837.0000 │ 1359.0000 │ ├───────┼───────────┼──────────┼──────────┼──────────┼───────────┤ │ expr… │ 553.0000 │ 0.0000 │ 314.0000 │ 365.0000 │ 648.0000 │ ├───────┼───────────┼──────────┼──────────┼──────────┼───────────┤ │ opti… │ 534.0000 │ 314.0000 │ 0.0000 │ 335.0000 │ 448.0000 │ ├───────┼───────────┼──────────┼──────────┼──────────┼───────────┤ │ requ… │ 837.0000 │ 365.0000 │ 335.0000 │ 0.0000 │ 786.0000 │ ├───────┼───────────┼──────────┼──────────┼──────────┼───────────┤ │ unde… │ 1359.0000 │ 648.0000 │ 448.0000 │ 786.0000 │ 0.0000 │ └───────┴───────────┴──────────┴──────────┴──────────┴───────────┘
  13. Understanding codependencies through winston • Now we need to weight

    the matrix based on the overall appearance of these codependencies 240 | async | 0.2761 207 | underscore | 0.2382 163 | express | 0.1875 133 | request | 0.1530 126 | optimist | 0.1449 869 total $PEFQFOEFODJFT
  14. Reading the tea leaves of dense data visualization • The

    size of the arc represents the degree of the codependency relationship with the parent module. • The size of the chord represents the degree of the codependency relationship between each pair. • The color of the chord represents the “dominant” module between the pair. winston $PEFQFOEFODJFT
  15. What problem do we solve for ? • Where do

    I store my private code? • Is my Node.js application secure? Against what vulnerabilities? • How do I deploy my application? • Am I at legal risk because of Open Source licenses? • What module should I use to do <feature> in my app? • Is this Open Source module good? YOU have QUESTIONS about your MODULES Stop wasting time and answer questions ???
  16.  GET TO THE POINT ALREADY CHARLIE! *TIPVMEVTFTUBUJDBOBMZTJTXJUI Using esprima

    and a dependency graph we were able to perform rudimentary analysis of hottest code paths. Gives author quick feedback instantly and avoids the silent majority
  17. '*/