From: Isaac Gouy <igouy@...>
Date: 2006-01-10T03:18:01+09:00
Subject: Re: Ideas on "Why Living Dangerous can be A Good Thing" in Ruby?

Eivind Eklund wrote:
> On 1/8/06, Gregory Brown <gregory.t.brown@gmail.com> wrote:
> > I mean, my general advice when it comes to ruby when asked about
> > security is that I basically respond, "There is none, but it's not as
> > bad as you'd expect.  Write proper test suites, code responsibly, and
> > make sure you nail down those edge cases.  Continuous integration is a
> > must,  and idiomatic code with proper style will help make the API
> > less likely to cause damage (such as the use of ! and other
> > indicators).
>
> There's documentation for how to do good APIs here:
> http://rpa-base.rubyforge.org/wiki/wiki.cgi?GoodAPIDesign
>
> I hope that's useful; feel free to edit and add/change/add discussion.
>
> > However, to the outsider, this is only an explanation of "how" to
> > overcome the apparent "flaw".  I'd like to do as good a job I can of
> > explaining why it isn't a flaw, when practiced correctly.
>
> Let's look at it as a cost/benefit analysis.  The cost of declaring
> variables and types end up as roughly half the code size.  That's
> twice the amount to write, and, more importantly twice the amount to
> read, twice the amount of places to change when refactoring, etc.  It
> also means that there's a lot of things we can't do, because we are
> "protected" from it.
>
> At this cost, the type and variable declarations had better give us a
> lot.  In practice, I find that they give me very little, bug wise:
> Maybe 5% of my simplest bugs are detected by them.  The advantages I
> get are in the speed of the compiled code, and as documentation.
> However, these benefits are too small to be worthwhile for the size
> projects I presently do (one and two person projects).

Does a language with type-inference require as many type and variable
declarations as a language without type-inference?

Is the C++ type system the same as the SML type system?

Will programmers who passively suffer compiler type-checking detect as
many bugs as programmers who actively use 'type-full' programming as a
checking-tool?

>
> I've implemented a system for doing run time checks of type
> declarations, it's available from RPA (as types) and from
> http://people.freebsd.org/~eivind/ruby/types/  This allows very
> flexible type checks for Ruby programs, adding whatever amount of type
> discipline you want.  In practice, I found this to just get in the way
> - it detected very few bugs, and added more stuff to change when I did
> refactoring.
> 
> Eivind.