8 ms·

Patterns for Defensive Programming in Rust

• empath75 1y ago
  This is one of the best Rust articles I've ever read. It's obviously from experience and covers a lot of _business logic_ foot guns that Rust doesn't typically protect you against without a little bit of careful coding that allows the compiler to help you. So many rust articles are focused on people doing dark sorcery with "unsafe", and this is just normal every day api design, which is far more practical for most people.
• brohee 1y ago
  The very useful TryFrom trait landed only in 1.34, so hopefully the code using unwrap_or_else() in From impl predates that... Actually the From trait documentation is now extremely clear about when to implement it (https://doc.rust-lang.org/std/convert/trait.From.html#when-to-implement-from https://doc.rust-lang.org/std/convert/trait.From.html#when-t...)
  • rolandog 1y ago
    As someone unfamiliar with Rust (yet! it's on my ever growing list of things I'd like to absorb into my brain), unwrap_or_else() sounds like part of the "What You See Is What I Threatened the Computer To Do" paradigm.
    • Y_Y 1y ago
      > INTERCAL has many other features designed to make it even more aesthetically unpleasing to the programmer: it uses statements such as "READ OUT", "IGNORE", "FORGET", and modifiers such as "PLEASE". This last keyword provides two reasons for the program's rejection by the compiler: if "PLEASE" does not appear often enough, the program is considered insufficiently polite, and the error message says this; if it appears too often, the program could be rejected as excessively polite.
      • strbean 1y ago
        Immediately thought of INTERCAL :)
      • rolandog 1y ago
        Oh wow! That's amazing! "I came to learn Computer Science, but I left with good bedside manners".
    • wongarsu 1y ago
      There are also the equally threatening and useful `map_or_else` (on Result and Option) and `ok_or_else` (on Option and experimentally on bool)
• J_Shelby_J 1y ago
  Wow that’s amazing. The partial equality implementation is really surprising. One question about avoiding boolean parameters, I’ve just been using structs wrapping bools. But you can’t treat them like bools… you have to index into them like wrapper.0. Is there a way to treat the enum style replacement for bools like normal bools, or is just done with matches! Or match statements? It’s probably not too important but if we could treat them like normal bools it’d feel nicer.
  • jvanderbot 1y ago
    I almost always prefer enums and matches! vs bool parameters. Another way is to implement a Trait that you find useful that encapsulates the logic. And don't forget you can do impl <Enum> {} blocks to add useful functions that execute regardless of which member of the enum you got. enum MyType{ ... } impl MyType{ pub fn is_useable_in_this_way(&self) -> bool{ // possibly ... match self {...} } } and later: pub fn use_in_that_way(e: MyType) { if e.is_useable_in_this_way() {...} } Or if you hate all that there's always: if let MyType::Member(x) = e { ... }
    • J_Shelby_J 1y ago
      If let is probably the closest to a regular bool. For ints you can implement the deref trait on structs. So you can treat YourType(u64) as a u64 without destructing. I couldn’t figure out a way to do that with YouType(bool).
  • tayo42 11mo ago
    I think you can do something like impl defref but not sure that's a good idea hah. Maybe it's a different trait I'm thinking of
• ggirelli 1y ago
  Loved the article, such a nice read. I am still slowly ramping up my proficiency in Rust and this gave me a lot of things to think through. I particularly enjoyed the temporary mutability pattern, very cool and didn't think about it before!
  • aw1621107 1y ago
    > I particularly enjoyed the temporary mutability pattern, very cool and didn't think about it before! It's not too uncommon in other languages (sometimes under the name "immediately invoked function expression"), though depending on the language you may see lambdas involved. For example, here's one of the examples from the article ported to C++: auto data = []() { auto data = get_vector(); auto temp = compute_something(); data.insert_range(data.end(), temp); std::ranges::sort(data); return data; }();
• stouset 1y ago
  Good article, but one (very minor) nit I have is with the PizzaOrder example. struct PizzaOrder { size: PizzaSize, toppings: Vec<Topping>, crust_type: CrustType, ordered_at: SystemTime, } The problem they want to address is partial equality when you want to compare orders but ignoring the ordered_at timestamp. To me, the problem is throwing too many unrelated concerns into one struct. Ideally instead of using destructuring to compare only the specific fields you care about, you'd decompose this into two structs: #[derive(PartialEq, Eq)] struct PizzaDetails { size: PizzaSize, toppings: Vec<Topping>, crust_type: CrustType, … // additional fields } #[derive(Eq)] struct PizzaOrder { details: PizzaDetails, ordered_at: SystemTime, } impl PartialEq for PizzaOrder { fn eq(&self, rhs: &Self) -> bool { self.details == rhs.details } } I get that this is a toy example meant to illustrate the point; there are certainly more complex cases where there's no clean boundary to split your struct across. But this should be the first tool you reach for.
  • hurril 1y ago
    You have a good point there, that is better. But it is still, well honestly, wrong. Two orders ordered at different times are just not the same order, and using a typeclass approach to say that they most definitely are is going to bite you in the back seat. PartialEq and Eq for PizzaDetails is good. If there is a business function that computes whether or not someone orders the same thing, then that should start by projecting the details.
    • zozbot234 1y ago
      You can solve this in the general case by implementing the typeclass for the coarser equality relation over an ad-hoc wrapper newtype.
      • hurril 1y ago
        Well it isn't a good call. This is the kind of code that OOP makes people write.
    • 1y ago
• perching_aix 1y ago
  This made me wonder, why aren't there usually teams whose job is to keep an eye on the coding patterns used in the various codebases? Similarly like how you have an SOC team who keeps monitoring traffic patterns, or an Operations Support team who keeps monitoring health probes, KPIs, and logs, or a QA who keeps writing tests against new code, maybe there would be value to keeping track of what coding patterns develop into over the course of the lifetime of codebases? Like whenever I read posts like this, they're always fairly anecdotal. Sometimes there will even be posts about how large refactor x unlocked new capability y. But the rationale always reads somewhat retconned (or again, anecdotal*). It seems to me that maybe such continuous meta-analysis of one's own codebases would have great potential utility? I'd imagine automated code smell checking tools can only cover so much at least. * I hammer on about anecdotes, but I do recognize that sentiment matters. For example, if you're planning work, if something just sounds like a lot of work, that's already going to be impactful, even if that judgement is incorrect (since that misjudgment may never come to light).
  • vlovich123 1y ago
    There are. All the big tech companies have them. It’s just difficult to accomplish when you have millions of lines of code.
    • perching_aix 1y ago
      Is there an industry standard name for these teams that I somehow missed then?
      • tczMUFlmoNk 1y ago
        You may wish to search for "readability at Google". Here is one article: https://www.moderndescartes.com/essays/readability/ https://www.moderndescartes.com/essays/readability/ (I have not read this article closely, but it is about the right concept, so I provide it as a starting point since "readability" writ large can be an ambiguous term.)
        • 1y ago
• schneems 1y ago
  This was posted with a (mostly) healthy discussion on lobste.rs, here's the link https://lobste.rs/s/ouy4dq/patterns_for_defensive_programming_rust https://lobste.rs/s/ouy4dq/patterns_for_defensive_programmin...
• emschwartz 1y ago
  Indexing into arrays and vectors is really wise to avoid. The same day Cloudflare had its unwrap fiasco, I found a bug in my code because of a slice that in certain cases went past the end of a vector. Switched it to use iterators and will definitely be more careful with slices and array indexes in the future.
  • 1718627440 1y ago
    Funny, it's really the same thing, why Rust people say we should abandon C. Meanwhile in C, it is also common to hand out handle instead of indices precisely due to this problem.
    • kstrauser 1y ago
      It's pretty similar, but writing `for item in container { item.do_it() }` is a lot less error prone than the C equivalent. The ha-ha-but-serious take is that once you get that snippet to compile, there's almost nothing you could ever do to break it without also making the compiler scream at you.
    • josephg 1y ago
      In rust, handing out indexes isn’t that common. It’s generally bad practice because your program will end up with extra, unnecessary bounds checks. Usually we program rust just the same as in C - get a reference (pointer) to an item inside the array and pass that around. The rust compiler ensures the array isn’t modified or freed while the pointer is held. (Which is helpful, but very inconvenient at times!)
  • josephg 1y ago
    > Cloudflare had its unwrap fiasco, Was it a fiasco? Really? The rust unwrap call is the equivalent to C code like this: int result = foo(…); assert(result >= 0); If that assert tripped, would you blame the assert? Of course not. Or blame C? No. If that assert tripped, it’s doing its job by telling you there’s a problem in the call to foo(). You can write buggy code in rust just like you can in any other language.
• Dowwie 1y ago
  I'm not reading a solid argument as to not use "..Defaults()" because doing so suggests that you may introduce a bug and therefore should be explicit about EVERYTHING instead? Ugh. Hard disagree.
  • ninkendo 1y ago
    Care to say why you disagree? Using ..Default::default() means “whatever additional fields are added later, I don’t care”. Which is great until someone needs to add a field to the struct, and they rely on the compiler to tell them all the places that don’t have a value for the field (so they can pass the right value depending on the situation.) Then the callers with Default are missed, and bugs can result. Any time you say “I don’t care what happens in the future here”, you better have a good reason for that to be the case, IMO.
    • Kinrany 11mo ago
      It's really unfortunate that Default is often interpreted as "recommended" when the trait makes/requires zero guarantees beyond the value being a valid member of the type.
• quotemstr 1y ago
  The tech industry is full of brash but lightly-seasoned people resurrecting discredited ideas for contrarianism cred and making the rest of us put down monsters we thought we'd slain a long time ago. "Defensive programming" has multiple meanings. To the extent it means "avoid using _ as a catch-all pattern so that the compiler nags you if someone adds an enum arm you need to care about", "defensive" programming is good. That said, I wouldn't use the word "defensive" to describe it. The term lacks precision. The above good practice ends up getting mixed up with the bad "defensive" practices of converting contract violations to runtime errors or just ignoring them entirely --- the infamous pattern in Java codebases of scrawling the following like of graffiti all over the clean lines of your codebase: if (someArgument == null) { throw new NullPointerException("someArgument cannot be null"); } That's just noise. If someArgument can't be null, let the program crash. Needed file not found? Just return ""; instead. Negative number where input must be contractually not negative? Clamp to zero. Program crashing because a method doesn't exist? if not: hasattr(self, "blah") return None People use the term "defensive" to refer to code like the above. They programs that "defend" against crashes by misbehaving. These programs end up being flakier and harder to debug than programs that are "defensive" in that they continually validate their assumptions and crash if they detect a situation that should be impossible. The term "defensive programming" has been buzzing around social media the past few weeks and it's essential that we be precise that 1) constraint verification (preferably at compile time) is good; and 2) avoidance of crashes at runtime at all costs after an error has occurred is harmful.
  • kstrauser 1y ago
    For a second I thought you were advocating for something of those, and I had a rant primed up. Yes. Defensively handle all the failure modes you know how to handle, but nothing else. If you're writing a service daemon and the user passes in a config filename that doesn't exist, crash and say why. Don't try to guess, or offer up a default config, or otherwise try to paper over the idea that the user asked you to do something impossible. Pretty much anything you try other than just crashing is guaranteed to be wrong. And for the love of Knuth, don't freaking clamp to zero or otherwise convert inputs into semantically different value than specified. (Like, it's fine to load a string representation of a float into an IEEE754 datatype if you're not working with money or other exact values. But don't parse 256 as 255 and call it good enough. It isn't.)
• Sunscratch 1y ago
  Nice article. The problem of multiple booleans is just one instance of a more general problem: when a function takes multiple arguments of the same type (i32, String, etc.). The newtype pattern allows you to create distinct types in such cases and enforce correctness at compile time.
• lilyball 1y ago
  In Pattern: Defensively Handle Constructors, it recommends using a nested inner module with a private Seal type. But the Seal type is unnecessary. The nested inner module is all you need, a private field `_private: ()` is only settable from within that inner module, so you don't need the extra private type.
• thatoneengineer 1y ago
  Aside from just being immensely satisfying, these patterns of defensive programming may be a big part of how we get to quality GAI-written code at scale. Clippy (and the Rust compiler proper) can provide so much of the concrete iterative feedback an agent needs to stay on track and not gloss over mistakes.
• deleted 1y ago
  [deleted]
• pornel 1y ago
  What's really nice is where you don't need defensive programming in Rust. If your function gets ownership of, or an exclusive reference to an object, then you know for sure that this reference, for as long as it exists, is the only one in the entire program that can access this object (across all threads, 3rd party libraries, recursion, async, whatever). References can't be null. Smart pointers can't be null. Not merely "can't" meaning not allowed and may throw or have a dummy value, but just can't. Wherever such type exists, it's already checked (often by construction) that it's valid and can't be null. If your object's getter lends an immutable reference to its field, then you know the field won't be mutated by the caller (unless you've intentionally allowed mutable "holes" in specific places by explicitly wrapping them in a type that grants such access in a controlled way). If your object's getter lends a reference, then you know the caller won't keep the reference for longer than the object's lifetime. If the type is not copyable/cloneable, then you know it won't even get copied. If you make a method that takes ownership of `self`, then you know for sure that the caller won't be able to call any more methods on this object (e.g. `connection.close(); connection.send()` won't compile, `future.then(next)` only needs to support one listener, not an arbitrary number). If you have a type marked as non-thread safe, then its instances won't be allowed in any thread-spawning functions, and won't be possible to send through channels that cross threads, etc. This is verified globally, across all code including 3rd party libraries and dynamic callbacks, at compile time.
  • Svoka 11mo ago
    Article mostly focuses on code practices to avoid making logical mistakes when iterating on your program.
  • zelphirkalt 11mo ago
    I fully agree with the actually great thing being what not to have to look out for and my first thought when seeing the headline was: "Doesn't the type system handle most of that stuff?" In other languages I get most of the benefits by sticking to functional programming practices and not mutating stuff all over the place. Rust's type system sort of encodes that, and maybe a little more, by making safe mutation a known non-interfering thing.
  • 11mo ago
• tayo42 1y ago
  >Using _ as a placeholder for unused variables can lead to confusion I would have guessed linters would have complained about what's being suggested there. Is the something special about var: _ thing that avoids it?
  • dwattttt 11mo ago
    Underscore acts as a wildcard, denoting that you don't want to bind a variable. Quoting the Rust reference[0]: > Underscore expressions, denoted with the symbol _, are used to signify a placeholder in a destructuring assignment. [0]: https://doc.rust-lang.org/reference/expressions/underscore-expr.html https://doc.rust-lang.org/reference/expressions/underscore-e...
• torginus 1y ago
  Defensive programming is a widely known antipattern : https://wiki.c2.com/?DefensiveProgramming https://wiki.c2.com/?DefensiveProgramming The 'defensive' nature refers to the mindset of the programmer (like when guilty people are defensive when being asked a simple question), that he isn't sure of anything in the code at any point, so he needs to constantly check every invariant. Enterprise code is full of it, and it can quickly lead to the program becoming like 50% error handling by volume, many of the errors being impossible to trigger because the app logic is validating a condition already checked in the validation layer. Its presence usually betrays a lack of understanding of the code structure, or even worse, a faulty or often bypassed validation layer, which makes error checking in multiple places actually necessary. One example is validating every parameter in every call layer, as if the act of passing things around has the ability to degrade information.
  • wavemode 1y ago
    The kind of defensive programming you're talking about has almost nothing to do with the contents of this article. This article is mostly just about structuring code so that bugs appear at compile time rather than runtime.
  • cracki 11mo ago
    It's not about fear of "degrading information". A function must check its arguments. It cannot assume that the arguments are already checked (against its own requirements). This is regardless of what called it, or where the values came from.
  • deleted 11mo ago
    [deleted]
• adastra22 1y ago
  This is a great article. Anyone know more content like this?
• germandiago 1y ago
  Some of the advice is applicable tp C++ as well. Enums and such things with non-exhaustive checks all have warnings and setting warnings as errors helps.
• swiftcoder 1y ago
  In the first example, the match feels extremely overkill. Vec.first() exposes the correct semantic (as does Vec.iter().nth(0) for the more general case), returning an Option.
  • miniBill 1y ago
    That's fine but the matching exposes that you should also handle the "has more than one element" case. And in general it's pointing to the idea of "try to not separate checks from code that depends on those checks"
  • fvncc 11mo ago
    Note its possible to write the example more succinctly (while having the same behavior) with: https://docs.rs/itertools/latest/itertools/trait.Itertools.html#method.exactly_one https://docs.rs/itertools/latest/itertools/trait.Itertools.h...
  • bigstrat2003 11mo ago
    I also think the first example has a solution which is worse than the purported problem it attempts to solve. If you're worried that someone might take the if statement out from around the vec index (I don't think this is actually a concern, but let's say it is for sake of argument), what's to stop someone from taking the match statement out from around your slice access? I can't see any reason why the solution isn't equally as vulnerable to the exact same problem. So the match approach doesn't seem to be adding value, while being much more verbose, and less clear. As you said, calling first() is a far better approach.
• sdeframond 11mo ago
  Those patterns look good. Question: how to encourage such patterns within a team? I often find it difficult to do it during code reviews and leading to unproductive arguments about "code style" and "preferences". Funnily, these arguments do not happen when a linter pops a warning instead...
• jgerrish 11mo ago
  This has already been hashed over a hundred thousand times, but there are also developer habits that we all need to defend against. One is pulling in needless crates. Rust encourages that behavior. Sometimes rightly, but it does build a habit. I spoke previously about how the Rust book uses the external rand create as a key example and it sets the tone for developers. I'm changing that stance somewhat since it was a decent strategic choice to have crypto packages plug-and-play. But tit still builds a habit.
  • gs17 11mo ago
    > I spoke previously about how the Rust book uses the external rand create as a key example and it sets the tone for developers. I'm changing that stance somewhat since it was a decent strategic choice to have crypto packages plug-and-play. But tit still builds a habit. Yeah, that originally turned me off from the language entirely. I also changed my mind eventually.