Live data from Hacker News

Can Types Replace Validation?

blog.ploeh.dk

11–20 of 35 posts

Re: Can Types Replace Validation?

#11

> Normal type systems (like C#'s) aren't Turing-complete. But it comes very very close: https://blog.hediet.de/post/how-to-stress-the-csharp-compile...

Though in most cases I reckon that enforcing constraints in the constructor is the right thing to do. It's not ideal, but it beats trying to write a constructive version of your program inside the type system.

Re: Can Types Replace Validation?

#12
post #10

> Normal type systems (like C#'s) aren't Turing-complete. But it comes very very close: https://blog.hediet.de/post/how-to-stress-the-csharp-compile...

TypeScript's type system however is Turing complete!

If I remember correctly, the original issue filed about this was more of an alert than an expression of excitement. In either case the exclamation is warranted, but it’s fascinating how since then the TS type system has grown significantly more expressive in the ways it can perform arbitrary computations. You certainly could write a compile-time JSON parser or a SQL database in TS types well before template literal types, but now you can do it with the semantics of a high level scripting language (hilariously [to me] more like a lisp than either JS or TS). Gob help us if anyone bolts arbitrary IO onto the thing to bring automatic type acquisition into the fray.

Re: Can Types Replace Validation?

#14
post #10

Earlier quoted context omitted.

TypeScript's type system however is Turing complete!

If I remember correctly, the original issue filed about this was more of an alert than an expression of excitement. In either case the exclamation is warranted, but it’s fascinating how since then the TS type system has grown significantly more expressive in the ways it can perform arbitrary computations. You certainly could write a compile-time JSON parser or a SQL database in TS types well before template literal t…

Oracle Types did just that (although it was an April Fools joke), it was quite fun to play with. https://github.com/microsoft/TypeScript/pull/43480

Re: Can Types Replace Validation?

#15
post #3

Another interesting idea I've read, I think in a Haskell context, is proofs attached to values. You prove that a string originating from the user was HTML escaped - by calling the HTMLEscape function which attaches the proof - and then later in the code whenever you output it in the template it won't be escaped anymore because it's proven to be escaped.

TLA+ [1] and Idris come to mind. Also Clojure Spec [2] For the specific case you mention, "taint analysis" would be appropriate.

[1] https://softwareengineeringdaily.com/2018/11/09/tla-with-les... [2] https://www.youtube.com/watch?v=oyLBGkS5ICk Edit: links

Re: Can Types Replace Validation?

#16
> This matters because understanding that a normal type system is not Turing-complete means that there are truths it can't express.

I thought Godel's incompleteness theorem makes this true for all systems of proofs beyond a certain complexity. Does it matter whether the type system is Turing-complete or not?

(I don't have a robust understanding of Godel's incompleteness theorem.)

Re: Can Types Replace Validation?

#17
post #6

This is accurate, but it leaves out something worth note: types can reduce the scope of validation needed. That's still a worthwhile outcome to work towards.

Doing application programming in Python now after some years of Scala, the uncertainty when I'm looking at code is overwhelming. What type will this argument be? Any type. What fields are optional in this record? All of them. Is this variable bound here? It depends. Will this line of code be executed on a computer? Maybe, but the next line of code may be daydreamed by a taco.

There are ways to fight against this uncertainty (Pydantic, etc.) but you learn to unit test every little damn thing.

Scala will make you feel stupid sometimes because you don't understand the ideas underlying a piece of code, but a language like Python makes you discount your ability to know anything. A line of code "x = y" might be exercised by three different unit tests, but maybe they didn't follow that one code path where y is never bound. I get more paranoid about simplifying logic in Python than I ever did in Scala. Reading other people's code is like being a jaded detective in a noir film. The function parameter is named user_count, but the last time you assumed a parameter like that was a number, you took a blackjack to the back of the head and woke up wanted for murder.

This is just an observation about one narrow aspect of Python, by the way. I'm productive in Python, it's fun, and it's an amazing experience. The feeling of proximity to power with Python is unrivaled.

Re: Can Types Replace Validation?

#18
post #16

> This matters because understanding that a normal type system is not Turing-complete means that there are truths it can't express. I thought Godel's incompleteness theorem makes this true for all systems of proofs beyond a certain complexity. Does it matter whether the type system is Turing-complete or not? (I don't have a robust understanding of Godel's incompleteness theorem.)

Sure, but it is possible to be Turing-complete. There may be further things a Turing machine can never do, but we want to do at least that much. If the type system is not “fully powerful” in this way it may be lacking in some useful aspect.

Re: Can Types Replace Validation?

#19
C#'s new compiler Roslyn added built in programmable linting with Roslyn Analyzers. You can run arbitrary code over the main source and raise compile time errors as desired. In theory you could implement all the desired checks in the compilation if not in the standard type system.

Re: Can Types Replace Validation?

#20
Types as they exist today provide shapes. But they dont provide l external limits. Every single type safe language Ive used (limited) merged together these concepts in the form of a stdlib pattern mixed with a “choose your own adventure” library or pattern. For example in typescript we use TS and lean heavily on zod. You cant avoid it. In TS especially you just have structural types so you have to filter everywhere on user defined or external data structures. Never mind setting limits on sizes, iterations, etc.

I think the primary problem is that the second we cross network or system boundaries all the guarantees go out the window. You have to be very defensive at every layer. If we’re ever able to encapsulate that in a type system that would be… impressive.

Post reply on HN