Live data from Hacker News

Programmers should never trust anyone, not even themselves

carbon-steel.github.io

41–50 of 163 posts

Re: Programmers should never trust anyone, not even themselves

#41
post #8
post #7

Earlier quoted context omitted.

trust but verify translates to trust no one but don't be a dick about it

To me, it's rather a postcondition instead of precondition. Trust that a person will do the right thing, but verify that the right thing has actually been done.

> postcondition instead of precondition.

How can you verify as a precondition instead of a postcondition? You can't verify anything until the act has been completed.

Re: Programmers should never trust anyone, not even themselves

#42
post #12

Earlier quoted context omitted.

If I had a dollar for each frontend test that actually don't actually test anything I would be able to retire by now!

Cargo cult testing. Some people don't understand the point of testing so they just go thru the motions and end up with something that makes no sense.

"It passed all the tests so it must be working, it must be something you are doing wrong"

Re: Programmers should never trust anyone, not even themselves

#43
This is a good post, and I agree with the "paranoid porgrammer" attitude being useful.

The post could also talk about yet another desirable paranoia, namely "Am I building the right thing?" - so talking to customers/clients/stakeholders/users is arguably one of the most important steps when seeking re-affirmation and controlling one's work. Nothing worse than people who think they understand a technical problem, but it's not the one that the customer wants solved...

Re: Programmers should never trust anyone, not even themselves

#44
post #24

Earlier quoted context omitted.

What's the meaning of "I trust you that the amount of cash you've given me is correct" when you then proceed to count it? If you're verifying, why do you need to say "I trust you"? A trustworthy and an untrustworthy person will get equally verified.

Has nothing to do with trust. I trust that you will give me the money. I also trust that you counted the right amount. But I still want to make sure you did not make a mistake.

I suppose the question is: why bother with trust? Why not just "verify"?

Re: Programmers should never trust anyone, not even themselves

#45
post #28
post #25

This is a really useful mindset as a programmer, but backfires in real-life as it makes you an anxious person.

I guess you need to compartmentalise into different kinds of 'trust'. The not 'trusting' you do with a computer is different from the trusting you do with fellow humans in daily life. They just happen to use the same word in English.

I trust the computer far more than the fellow humans. The computer will generally give a predictable output for a given input. "fellow humans in daily life" .... not so much.

Re: Programmers should never trust anyone, not even themselves

#46
post #12

Earlier quoted context omitted.

If I had a dollar for each frontend test that actually don't actually test anything I would be able to retire by now!

Cargo cult testing. Some people don't understand the point of testing so they just go thru the motions and end up with something that makes no sense.

Only needs to be management that misunderstands.

I’ve written plenty of do nothing tests in my time to be sure that management regularly got a report of tests being added.

Re: Programmers should never trust anyone, not even themselves

#47
post #4

>> Random access of a character in a text buffer could take constant time (for ASCII) or linear time (for UTF-8) depending on the character encoding This is true, but incomplete. All unicode encodings take linear time, not just utf-8. That's because a character can contain multiple code points. Utf-32 allows for random access of code points in constant time, but not characters. Utf-16 has variable length code points…

Yeah, but the author was talking about ASCII. ASCII takes constant time.

The author differentiated I the statement between ASCII and utf-8. The reference to the specific encoding (utf-8) was misleading because the reference should have been to Unicode (the mapping) as the issue applies to all Unicode encodings, and is not limited to utf-8.

ASCII does indeed take constant time - which I agreed with.

Re: Programmers should never trust anyone, not even themselves

#48
I think "trust, but verify" (as mentioned in the article) is a much more useful motto than "never trust anyone". The latter isn't an useful attitude, if you took it seriously you would have carefully check or rewrite everything from the ground up. And then you'd either have to trust the hardware anyway or enlist in a course on VLSI design. "Trust, but verify" is much more practicable, at least if you don't feel the need to verify absolutely everything[0], but is content with doing spot checks of all the features.

So, good article with a misleading title. Don't be paranoid.

[0] I don't consider 100% test coverage as anywhere near close enough for that.

Re: Programmers should never trust anyone, not even themselves

#49
post #11
post #9

> Failing tests indicate the presence of bugs, but passing tests do not promise their absence. If only :) Far too often I find myself working with tests that patch one too many implementation details, putting me in a refactoring pickle

Or even worse, tests that test implementation details that doesn't matter for the actual outcome.

One thing I do sometimes is to start part of an API in a TDD style. Everything starts very "basic", which adds a lot of relatively trivial test cases.

When done with that phase and my API looks relatively functional, I remove all relatively trivial tests and I write bigger ones, often randomized and property-based.

This works decently well and you do not have an army of useless tests there hanging after the process is done.

Re: Programmers should never trust anyone, not even themselves

#50
post #11

Earlier quoted context omitted.

Or even worse, tests that test implementation details that doesn't matter for the actual outcome.

Used to be (perhaps still is) a nasty habit of Rails apps to have vast test suites covering every Active Record query they ever used (with fixed seeds to boot), rarely straying from giving the bog-standard and already very thoroughly tested and battle-scarred AR predicate builder a wholly unneeded workout; but none of their own front-end code because writing for selenium was too hard. But look! Thousands of tests and…

> but none of their own front-end code because writing for selenium was too hard.

I've also seen plenty of tests that test if a template was rendered rather than if whatever thing it actually outputs was in the output. It is just calcifying the impementation making it hard to test.

But it is a tradeoff, and a hard one as well, because if you do all things all the time, combining all variations of database with all variations of the views, then you end up with a test suite that take forever to run. Finding the right tradeoff there has not shown itself to be very obvious, sadly.

Post reply on HN