Amber - the programming language compiled to Bash (amber-lang.com)
from syd@lemy.lol to programming@programming.dev on 21 May 2024 17:59
https://lemy.lol/post/25353828

New favorite tool šŸ˜

#programming

threaded - newest

sudo42@lemmy.world on 21 May 2024 18:08 next collapse

One day, someoneā€™s going to have to debug machine-generated Bash. <shivver>

shutz@lemmy.ca on 21 May 2024 18:50 next collapse

You can do that today. Just ask Chat-GPT to write you a bash script for something non-obvious, and then debug what it gives you.

seaQueue@lemmy.world on 21 May 2024 19:41 collapse

For maximum efficiency weā€™d better delegate that task to an intern or newly hired jr dev

lawrence@lemmy.world on 21 May 2024 18:32 next collapse

This is glorious.

Linkerbaan@lemmy.world on 21 May 2024 18:56 next collapse

let

<img alt="" src="https://lemmy.world/pictrs/image/a066937e-0af9-44b7-93e9-6b42bdbc5301.jpeg">

FizzyOrange@programming.dev on 21 May 2024 19:19 collapse

What are you talking about?

moreeni@lemm.ee on 21 May 2024 19:24 next collapse

About the let keyword, which is used to declare a variable.

FizzyOrange@programming.dev on 21 May 2024 20:18 collapse

I thought so, but why do they object? Do they want Bashā€™s error-prone implicit variable declaration?

moreeni@lemm.ee on 21 May 2024 20:48 collapse

They, most probably, just didnā€™t like the name.

Linkerbaan@lemmy.world on 21 May 2024 19:22 collapse

The Javascript style syntax

AdamBomb@lemmy.sdf.org on 23 May 2024 15:57 collapse

let is also used to declare values in better languages than JavaScript, such as Haskell and ML family languages like OCaml and F#

morrowind@lemmy.ml on 21 May 2024 19:10 next collapse

How is it using something like this vs just a bash alternative. Can you use this in the shell or only as a compiled language?

FizzyOrange@programming.dev on 21 May 2024 21:21 collapse

If you can use an alternative then do that. This is for situations where you canā€™t use an alternative or donā€™t want users to have to install anything else.

morrowind@lemmy.ml on 22 May 2024 01:24 collapse

you still have to install this though

FizzyOrange@programming.dev on 22 May 2024 10:06 collapse

You donā€™t have to install it on the machine where the script is run. Thatā€™s the point.

thingsiplay@beehaw.org on 21 May 2024 19:15 next collapse

Basically another shell scripting language. But unlike most other languages like Csh or Fish, it can compile back to Bash. At the moment I am bit conflicted, but the thing it can compile back to Bash is what is very interesting. Iā€™ll keep an eye on this. But it makes the produced Bash code a bit less readable than a handwritten one, if that is the end goal.

curl -s ā€œhttps://raw.githubusercontent.com/Ph0enixKM/AmberNative/master/setup/install.shā€ | $(echo /bin/bash)

I wish this nonsense of piping a shell script from the internet directly into Bash would stop. Itā€™s a bad idea, because of security concerns. This install.sh script eval and will even run curl itself to download amber and install it from this url

url=ā€œhttps://github.com/Ph0enixKM/${__0_name}/releases/download/${__2_tag}/amber_${os}_${arch}ā€ ā€¦ echo ā€œPlease make sure that root user can access /opt directory.ā€;

And all of this while requiring root access.

I am not a fan of this kind of distribution and installation. Why not provide a normal manual installation process and link to the projects releases page: github.com/Ph0enixKM/Amber/releases BTW its a Rust application. So one could build it with Cargo, for those who have it installed.

FizzyOrange@programming.dev on 21 May 2024 19:23 next collapse

I wish this nonsense of piping a shell script from the internet directly into Bash would stop. Itā€™s a bad idea, because of security concerns.

I would encourage you to actually think about whether or not this is really true, rather than just parroting what other people say.

See if you can think of an exploit I perform if you pipe my install script to bash, but I canā€™t do it you download a tarball of my program and run it.

while requiring root access

Again, think of an exploit I can do it you give me root, but I canā€™t do if you run my program without root.

(Though I agree in this case it is stupid that it has to be installed in /opt; it should definitely install to your home dir like most modern languages - Go, Rust, etc.)

onlinepersona@programming.dev on 21 May 2024 19:53 next collapse

I would encourage you to actually think about whether or not this is really true, rather than just parroting what other people say.

I would encourage you to read up on the issue before thinking they havenā€™t.

See if you can think of an exploit I perform if you pipe my install script to bash, but I canā€™t do it you download a tarball of my program and run it.

Here is the most sophisticated exploit: Detecting the use of ā€œcurl | bashā€ server side.

It is also terrible conditioning to pipe stuff to bash because itā€™s the equivalent of ā€œjust execute this .exe, broā€. Sure, right now itā€™s github, but there are other curl|bash installs that happen on other websites.

Additionally a tar allows one to install a program later with no network access to allow reproducible builds. curl|bash is not repoducible.

Anti Commercial-AI license

BatmanAoD@programming.dev on 21 May 2024 21:01 collapse

Butā€¦ā€œjust execute this .exe, broā€ is generally the alternative to pipe-to-Bash. Have you personally compiled the majority of software running on your devices?

DaPorkchop_@lemmy.ml on 21 May 2024 21:19 next collapse

No, it was compiled by the team which maintains my distroā€™s package repository, and cryptographically verified to have come from them by my package manager. Thatā€™s a lot different than downloading some random executables I pulled from a website Iā€™d never heard of before and immediately running them as root.

BatmanAoD@programming.dev on 22 May 2024 03:32 next collapse

Yes, I agree package managers are much safer than curl-bash. But do you really only install from your platformā€™s package manager, and only from its central, vetted repo? Including, say, your browser? Moreover, even if you personally only install pre-vetted software, itā€™s reasonable for new software to be distributed via a standalone binary or install script prior to being added to the package manager for every platform.

Miaou@jlai.lu on 23 May 2024 18:00 collapse

Everything youā€™ve ever needed was available in your distroā€™s package manager?

onlinepersona@programming.dev on 21 May 2024 21:36 collapse

Are you seriously comparing installing from a repo or ā€œapp storeā€ to downloading a random binary on the web and executing it?

P.S Iā€™ve compiled a lot of stuff using nix, especially when itā€™s not in the cache yet or I have to modify the package myself.

Anti Commercial-AI license

BatmanAoD@programming.dev on 22 May 2024 03:29 collapse

No, I agree that a package manager or app store is indeed safer than either curl-bash or a random binary. But a lot of software is indeed installed via standalone binaries that have not been vetted by package manager teams, and most people donā€™t use Nix. Even with a package manager like apt, there are still ways to distribute packages that arenā€™t vetted by the central authority owning the package repo (e.g. for apt, that mechanism is PPAs). And when introducing a new piece of software, itā€™s a lot easier to distribute to a wide audience by providing a standalone binary or an install script than to get it added to every platformā€™s package manager.

tgt@programming.dev on 21 May 2024 19:53 next collapse

It is absolutely possible to know as the server serving a bash script if it is being piped into bash or not purely by the timing of the downloaded chunks. A server could halfway through start serving a different file if it detected that it is being run directly. This is not a theoretical situation, by the way, this has been done. At least when downloading the script first you know what youā€™ll be running. Same for a source tarball. Thatā€™s my main gripe with this piping stuff. It assumes you donā€™t even care about the security.

FizzyOrange@programming.dev on 21 May 2024 20:19 collapse

That makes the exploit less detectable sure. Not fundamentally less secure though.

This is not a theoretical situation, by the way, this has been done

Link btw? I have not heard of an actual attack using this.

[deleted] on 21 May 2024 19:57 next collapse

.

nick@midwest.social on 21 May 2024 23:59 collapse

Whoa, thatā€™s a real bad take there bud. You are completely and utterly wrong.

FizzyOrange@programming.dev on 22 May 2024 10:07 collapse

Convincing rebuttal šŸ˜„

eveninghere@beehaw.org on 22 May 2024 00:28 collapse

I mean, you can always just download the script, investigate it yourself, and run it locally. Iā€™d even argue itā€™s actually better than most installers.

30p87@feddit.de on 23 May 2024 07:31 collapse

Install scripts are just the Linux versions of installer exes. Hard and annoying to read, probably deviating from standard behaviour, not documenting everything, probably being bound to specific distros and standards without checks, assuming stuff way too many times.

popcar2@programming.dev on 21 May 2024 19:20 next collapse

Compiling to bash seems awesome, but on the other hand I donā€™t think anyone other than the person who wrote it in amber will run a bash file that looks like machine-generated gibberish on their machine.

zalgotext@sh.itjust.works on 21 May 2024 19:33 next collapse

Compiling to bash seems awesome

See, i disagree because

I donā€™t think anyone other than the person who wrote it in amber will run a bash file that looks like machine-generated gibberish on their machine.

Lol I barely want to run (or read) human generated bash, machine generated bash sounds like a new fresh hell that I donā€™t wanna touch with a ten foot pole.

FizzyOrange@programming.dev on 21 May 2024 21:18 collapse

I disagree. People run Bash scripts they havenā€™t read all the time.

Hell some installers are technically Bash scripts with a zip embedded in them.

Thcdenton@lemmy.world on 21 May 2024 19:30 next collapse

<img alt="" src="https://lemmy.world/pictrs/image/a7b596c2-f306-4ef3-8c1e-d398dfbb8342.jpeg">

Thereā€™s a joke here but Iā€™m not clever enough to make it.

eager_eagle@lemmy.world on 21 May 2024 19:44 next collapse

what browser are you using? It renders just fine on mobile and desktop to me

Thcdenton@lemmy.world on 21 May 2024 20:03 collapse

Whatever boost defaults to on a note9

driving_crooner@lemmy.eco.br on 22 May 2024 03:21 collapse

Pretty cool bug. Looks like a surreal meme

eager_eagle@lemmy.world on 21 May 2024 19:48 next collapse

with no support for associative arrays (dicts / hashmaps) or custom data structs this looks very limited to me

FizzyOrange@programming.dev on 21 May 2024 21:20 collapse

Does Bash support those? I think the idea is that itā€™s basically Bash, as if written by a sane person. So it supports the same features as Bash but without the army of footguns.

eager_eagle@lemmy.world on 21 May 2024 23:54 next collapse

it does, well at least associative arrays

BatmanAoD@programming.dev on 22 May 2024 14:30 collapse

A language being compiled should be able to support higher-level language concepts than what the target supports natively. Thatā€™s how compiling works in the first place.

FizzyOrange@programming.dev on 22 May 2024 18:30 collapse

That depends on how readable you want the output to be. Itā€™s already pretty bad on that front. If you start supporting arbitrary features itā€™s going to end up as a bytecode interpreter. Which would be pretty cool too tbf! Has anyone written a WASM runtime in bash? šŸ˜„

BatmanAoD@programming.dev on 22 May 2024 21:38 collapse

Honestly, wouldnā€™t it be great if POSIX eventually specified a WASM runtime?

FizzyOrange@programming.dev on 22 May 2024 21:45 collapse

Yeah definitely! I wouldnā€™t hold your breath though. Especially as thatā€™s pretty much an escape route from POSIX. I doubt theyā€™d be too keen to lose power.

zygo_histo_morpheus@programming.dev on 21 May 2024 20:15 next collapse

Looking at the example

<img alt="" src="https://programming.dev/pictrs/image/2a002f32-9529-4854-af56-c491a672cb88.png">

Why does the generated bash look like that? Is this more safe somehow than a more straighforward bash if or does it just generate needlessly complicated bash?

thingsiplay@beehaw.org on 21 May 2024 20:28 next collapse

Especially as Bash can do that anyway with if [ ā€œ${__0_age}ā€ -lt 18 ] as an example, and could be straight forward. Also Bash supports wildcard comparison, Regex comparison and can change variables with variable substitution as well. So using these feature would help in writing better Bash. The less readable output is expected though, for any code to code trans-compiler, its just not optimal in this case.

BatmanAoD@programming.dev on 21 May 2024 20:55 collapse

Itā€™s probably just easier to do all arithmetic in bc so that thereā€™s no need to analyze expressions for Bash support and have two separate arithmetic codegen paths.

thingsiplay@beehaw.org on 21 May 2024 21:35 collapse

But its the other way, not analyzing Bash code. The code is already known in Amber to be an expression, so converting it to Bash expression shouldnā€™t be like this I assume. This just looks unnecessary to me.

BatmanAoD@programming.dev on 22 May 2024 03:37 collapse

No, I mean, analyzing the Amber expression to determine if Bash has a native construct that supports it is unnecessary if all arithmetic is implemented using bc. bc is strictly more powerful than the arithmetic implemented in native Bash, so just rendering all arithmetic as bc invocations is simpler than rendering some with bc and some without.

Note, too, that in order to support Macs, the generated Bash code needs to be compatible with Bash v3.

thingsiplay@beehaw.org on 22 May 2024 04:17 collapse

I see, itā€™s a universal solution. But the produced code is not optimal in this case. I believe the Amber code SHOULD analyze it and decide if a more direct and simple code generation for Bash is possible. That is what I would expect from a compilers work. Otherwise the generated code becomes write only, not read only.

BatmanAoD@programming.dev on 22 May 2024 04:23 collapse

Compiled code is already effectively write-only. But I can imagine there being some efficiency gains in not always shelling out for arithmetic, so possibly thatā€™s a future improvement for the project.

That said, my reaction to this project overall is to wonder whether there are really very many situations in which itā€™s more convenient to run a compiled Bash script than to run a compiled binary. I suppose the Bash has the advantage of being truly ā€œcompile once, run anywhereā€.

dyc3@lemmy.world on 21 May 2024 20:31 next collapse

Yeah that shit is completely unreadable

steersman2484@sh.itjust.works on 21 May 2024 20:54 next collapse

So many forks for something that can be solved entirely with bash inbuilts

sxt@lemmy.world on 22 May 2024 00:24 collapse

I doubt the goal is to produce easily understood bash, otherwise youā€™d just write bash to begin with. Itā€™s probably more similar to a typescript transpiler that takes in a language with different goals and outputs something the interpreter can execute quickly (no comment on how optimized this thing is).

green_dot@le.fduck.net on 21 May 2024 20:27 next collapse

when people have too much free time

fourwd@programming.dev on 21 May 2024 20:59 next collapse

The language idea is good, but: THREE.WebGLRenderer: A WebGL context could not be created. Reason: WebGL is currently disabled.

Seriously? Why do I need WebGL to read TEXT in docs? :/

eveninghere@beehaw.org on 22 May 2024 00:31 next collapse

Why not compile it to sh though.

jack@monero.town on 22 May 2024 00:52 collapse

There is no sh shell. /bin/sh is just a symlink to bash or dash or zsh etc.

But yes, the question is valid why it compiles specifically to bash and not something posix-compliant

emptiestplace@lemmy.ml on 22 May 2024 03:03 collapse

There is no sh shell.

lol

jack@monero.town on 22 May 2024 11:41 collapse

Yes, there was the bourne sh on Unix but I donā€™t see how thatā€™s relevant here. Weā€™re talking about operating systems in use. Please explain the downvotes

BatmanAoD@programming.dev on 22 May 2024 14:41 collapse

Itā€™s relevant because there are still platforms that donā€™t have actual Bash (e.g. containers using Busybox).

sh is not just a symlink: when invoked using the symlink, the target binary must run in POSIX compliant mode. So itā€™s effectively a sub-dialect.

Amber compiles to a language, not to a binary. So ā€œwhy doesnā€™t it compile to shā€ is a perfectly reasonable question, and refers to the POSIX shell dialect, not to the /bin/sh symlink itself.

jack@monero.town on 22 May 2024 15:10 collapse

Thanks

fmstrat@lemmy.nowsci.com on 22 May 2024 02:29 next collapse

Why not writeā€¦ Bash?

cadekat@pawb.social on 22 May 2024 02:32 next collapse

Hereā€™s a language that does bash and Windows batch files: github.com/batsh-dev-team/Batsh

I havenā€™t used either tool, so I canā€™t recommend one over the other.

thingsiplay@beehaw.org on 22 May 2024 04:22 next collapse

The only issue I have is the name of the project. They should have gone with a more distinct name.

vvv@programming.dev on 22 May 2024 07:44 collapse

I canā€™t believe they didnā€™t with go with BatShIt. itā€™s right there! they were SO close!

felbane@lemmy.world on 22 May 2024 18:56 collapse

If their official website isnā€™t batsh.it Iā€™m going to be very sad.

Edit: ā˜¹ļø

starman@programming.dev on 22 May 2024 05:53 next collapse

Cool website

Leate_Wonceslace@lemmy.dbzer0.com on 22 May 2024 12:13 next collapse

Iā€™m a mathematician with very limited programming experience. Can someone explain the significance of this?

choroalp@programming.dev on 22 May 2024 14:49 next collapse

Basically dealing with abandoned-by-god syntax and limitations of bash. You can abstract them away!

Tyfon@programming.dev on 22 May 2024 15:01 collapse

Bash is one of the most used shell language, itā€™s installed on almost all Linux and Mac systems and can also be used on windows. Almost no one likes writing it as it is convoluted and really really hard to read and write. There are many replacement languageā€™s for it, but using them is troublesome, because of incompatibilities. Amber is compiled which will solve problems with compatibility and it seems that language itself is very readable. On top of that it has most futures that modern programmers need.

Leate_Wonceslace@lemmy.dbzer0.com on 22 May 2024 16:02 collapse

Thank you, I think I understand now. šŸ™‚

bss03@infosec.pub on 22 May 2024 15:45 next collapse

Late to the party. Idris had a bash backend (i.e. you could compile Idris to bash), and itā€™s already bit rotted with new Idris versions.

I hope the language is at least as cool as Idris.

sudo@programming.dev on 23 May 2024 02:30 next collapse

Iā€™m very suspicious of the uses cases for this. If the compiled bash code is unreadable then whatā€™s the point of compiling to bash instead of machine code like normal? It might be nice if youā€™re using it as your daily shell but if someone sent me ā€œcompiledā€ bash code I wouldnā€™t touch it. My general philosophy is if your bash script gets too long, move it to python.

The only example I can think of is for generating massive install.sh

clot27@lemm.ee on 23 May 2024 09:51 next collapse

Gotta try, the website seems amazing

pkill@programming.dev on 23 May 2024 10:10 next collapse

Cool to see that after Cotowali was sadly abandoned due to lack of funding. Please, fund the FOSS projects you use!

Euro@programming.dev on 23 May 2024 15:36 next collapse

As someone who has done way too much shell scripting, the example on their website just looks bad if iā€™m being honest.

I wrote a simple test script that compares the example output from this script to how i would write the same if statement but with pure bash.

hereā€™s the script:

#!/bin/bash

age=3

[ "$(printf "%s < 18\n" "$age" | bc -l | sed '/\./ s/\.\{0,1\} 0\{1,\}$//')" != 0  ] && echo hi

# (( "$age" < 18 )) && echo hi

Comment out the line you dont want to test then run hyperfine ./script

I found that using the amber version takes ~2ms per run while my version takes 800microseconds, meaning the amber version is about twice as slow.

The reason the amber version is so slow is because: a) it uses 4 subshells, (3 for the pipes, and 1 for the $() syntax) b) it uses external programs (bc, sed) as opposed to using builtins (such as the (( )), [[ ]], or [ ] builtins)

I decided to download amber and try out some programs myself.

I wrote this simple amber program

let x = [1, 2, 3, 4]
echo x[0]

it compiled to:

__AMBER_ARRAY_0=(1 2 3 4);
__0_x=("${__AMBER_ARRAY_0[@]}");
echo "${__0_x[0]}"

and i actually facepalmed because instead of directly accessing the first item, it first creates a new array then accesses the first item in that array, maybe thereā€™s a reason for this, but i donā€™t know what that reason would be.

I decided to modify this script a little into:

__AMBER_ARRAY_0=($(seq 1 1000));
__0_x=("${__AMBER_ARRAY_0[@]}");
echo "${__0_x[0]}"

so now we have 1000 items in our array, I bench marked this, and a version where it doesnā€™t create a new array. not creating a new array is 600ms faster (1.7ms for the amber version, 1.1ms for my version).

I wrote another simple amber program that sums the items in a list

let items = [1, 2, 3, 10]
let x = 0
loop i in items {
    x += i
}

</
DevopsPalmer@lemmy.dbzer0.com on 23 May 2024 16:25 collapse

This is the complete review write up I love to see, letā€™s not get into the buzzword bingo and just give me real world examples and comparisons. Thanks for doing the real work šŸ™‚

AdamBomb@lemmy.sdf.org on 23 May 2024 15:59 next collapse

I like the idea in principle. For it to be worth using though, it needs to output readable Bash.

Evotech@lemmy.world on 23 May 2024 16:26 collapse

Why?

AdamBomb@lemmy.sdf.org on 23 May 2024 23:45 collapse

Because you still need to be able to understand whatā€™s actually getting executed. Thereā€™s no debugger so youā€™ll still be debugging Bash.

yetAnotherUser@lemmy.ca on 23 May 2024 16:08 next collapse

I checked the docs, and Iā€™m a bit confused with one thing. They show that you can capture the stdout of a command into a variabe, but they never show stderr being captured. How would that work?

syd@lemy.lol on 23 May 2024 16:14 collapse

Like this: ā€˜ā€™ā€™ $mv file.txt dest.txt$ failed { echo ā€œIt seems that the file.txt does not existā€ } ā€˜ā€™ā€™

yetAnotherUser@lemmy.ca on 23 May 2024 18:58 collapse

Knowing if a command failed and capturing stderr (which contains stuff like error messages) are not the same thing.

Code@programming.dev on 23 May 2024 16:53 next collapse

Just learn Bash lol

syd@lemy.lol on 23 May 2024 17:18 collapse

Iā€™m trying but Iā€™m shooting my own foot all the time šŸ˜¢

zzx@lemmy.world on 23 May 2024 17:41 collapse

Itā€™s okay itā€™s filled with foot guns.

sexy_peach@beehaw.org on 23 May 2024 17:37 next collapse

Why and where would this be useful?

ReluctantMuskrat@lemmy.world on 23 May 2024 19:11 collapse

As a long-time bash, awk and sed scripter who knows heā€™ll probably get downvoted into oblivion for this my recommendation: learn PowerShell

Itā€™s open-source and completely cross-platform - I use it on Macs, Linux and Windows machines - and you donā€™t know what youā€™re missing until you try a fully objected-oriented scripting language and shell. No more parsing text, built-in support for scalars, arrays, hash maps/associative arrays, and more complex types like version numbers, IP addresses, synchronized dictionaries and basically anything available in .Net. Read and write csv, json and xml natively and simply. Built-in support for regular expressions throughout, web service calls, remote script execution, and parallel and asynchronous jobs and lots and lots of libraries for all kinds of things.

Seriously, I know its popular and often-deserved to hate on Microsoft but PowerShell is a kick-ass, cross-platform, open-source, modern shell done right, even if it does have a dumb name imo. Once you start learning it you wonā€™t want to go back to any other.

caseyweederman@lemmy.ca on 23 May 2024 21:34 next collapse

I appreciate you sharing your perspective. Mine runs counter to it.
The more PowerShell I learn, the more I dislike it.

jelloeater85@lemmy.world on 24 May 2024 02:26 collapse

As someone who spent 2 years learning and writing PowerShell for workā€¦ Itā€™sā€¦ Okay. Way easier to make stuff work then bash, and gets really powerful when you make libraries for it. Butā€¦ I prefer Python and GoLang for building scripts and small apps.

jelloeater85@lemmy.world on 24 May 2024 02:26 collapse

Do you write it for work?

ReluctantMuskrat@lemmy.world on 24 May 2024 17:49 collapse

I do. Currently I use it mostly for personal stuff as part of my time spent on production support. Importing data from queries, exporting spreadsheets, reading complex json data and extracting needed info, etc. In the past when I was on DevOps used it with Jenkins and various automation processes, and Iā€™ve used it as a developer to create test environments and test data.

jelloeater85@lemmy.world on 24 May 2024 20:00 collapse

Nice! Sounds like a good use case.