James Course - The Representable/Valid Principle

Question 1

Building something that does the right thing is easy. What is the challenge?

Answer 1

The challenge is to build something that can’t do the wrong thing.

Maintain a one-to-one correspondence between representable and valid states of your program.

One thing is what your program can do, another is what your program should do.

Question 2

How can we eliminate an entire class of bugs?

Answer 2

By making sure that our program state space can’t represent invalid states and invalid transitions through states can’t happen.
Remember about the Thread.start vs Thread.run example.

Question 3

How the Representable/Valid Principle changes our view of software?

Answer 3

The principle makes us understand how software is a collection of states, and transitions between theses states.

Thought this lenses of transitions and states we can constrain the state space to make bugs impossible.

Question 4

Imagine a specific method can’t be called before calling another one. How can you make sure they will never be called in the wrong order?

Answer 4

You can move the second method to another object and make the first method return this object.

Question 5

task.await(true)

true stands for interruptible tasks, how to prevent users of this API to make a mistake?

Answer 5

Use an enum

task.await(INTERRUPTIBLE)

Question 6

Rectangle(int x, int y, int width, int height)

How to prevent programmers from passing parameters in the wrong order?

Answer 6

Use keyword arguments, or ask for a point and a dimension object instead of integers. Avoid primitive obsession.

Question 7

What is the external view?

Answer 7

The external view looks at state transitions and help us to eliminate bad transitions.

Question 8

What is the internal view?

Answer 8

The internal view look at what possible states could exist given the variables we have and help us to eliminate bad states.

Question 9

When we create a object usually it has a representation invariant that described what must be true to be valid state representation. What invariant should we strive for?

Answer 9

We should strive for not having a representation invariant, that is, concrete state representations that always satisfies the invariant, that is, all concrete values are valid.

Remember the Oven example:

class Oven
  bool isOn, isBroil, isBake
  int bakeTemp

Representation invariant
¬(isBroil & isBake) &
((isBroil | isBake) => isOn) &
(isBake <=> bakeTemp != null)

The mapping between concrete states and abstract states is not 1 to 1.

Question 10

What tools can we use to remove invalid state representations?

Answer 10

We can use algebraic data type like a sum or a product.

Use precise types to represent your data.

Question 11

What is the power of design?

Answer 11

Is not in what it can do, but in what it can’t do.

Our goal is to design programs where is easy to do the right thing and impossible to do the wrong thing.

Question 12

Should we have the possibility of having two concretes states representing the same abstract state?

Answer 12

No, the Representable/Valid Principle says that we should have a 1 to 1 mapping between concrete and abstract representations, that is, an injective function between concrete and abstract representations.

Question 13

Which techniques were used in the JMock library that prevented library misuse?

Answer 13

The use of interfaces to define the syntax of JMock. This technique restricted the order that methods were allowed to be called.

Implement the syntax interfaces in Builder objects: These builder objects allowed the program to be built in two layers, one for the syntax and another one for the interpreter. The syntax layer was focused on providing methods to describe what we wanted the program to do in a declarative manner. When called these methods would build the object graph (interpretation layer) that executed the computation.

Question 14

What is the fundamental idea behind returning one token object that is needed to call other methods (that is, enforcing ordering)?

Answer 14

The token represents a proof of work that should happen before calling some other method.

Question 15

What does the abstract function do?

Answer 15

It removes the details of the implementation and only keeps what is essential to represent the abstract concept. Remember about the ring buffered queue.

Question 16

What is another way of describing the good taste of Linus about removing edge cases?

Answer 16

Edge cases probably mean your representation has invalid states, so reducing the number of edge cases you will probably reduce the number of invalid states, thus, following the representable valid principle

Question 17

What the bugs and battleships article talked about?

Answer 17

It uses an analogy with the game Battleship to talk about different strategies we can use to test our software. The sea would be all possibles tests we could write, and the missiles would be the ones we have chosen.

The greatest conclusion was that in order to use equivalent partitioning in your software you have to find tests that generalize. Chunks of the test input space which are said to be equivalent to each other correspond to a single case, part of a larger mathematical proof.

The ability to generalize behavior of specific tests to the behavior of the program is precisely what distinguishes a good program from a bad one. So… good programs are easy to prove correct.

Question 18

What was the problem in libcurl that caused a huge number of vulnerabilities?

Answer 18

There were a bunch of inconsistency uses of the API. There was this specific function to set up which validations the library should do and it took two constants as input, the first one was a true/false value, and the second one was supposed to be 1 or 2. The default value was 2, that meant to perform security validations, but people misused the library and set the value to true, and true is converted to 1, disabling the security check.