A record-breaking run of high temperatures in Sydney, broken air conditioning, wifey’s odd work schedule, and a handful of things to deal with at once at work conspired last week to suppress any motivation I may have had to do any programming at home.

…although, okay, I did update a couple of my toy Go programs to work with the changes to channel syntax. I forget sometimes that Go is still quite firmly in the early-adopter stage.

Anyway, not much to report, so here’s something sort of cool – a genetic algorithm to designevolve a car.

A few orders of business heading into the new year…

• My resolution for 2010 to learn to use Emacs properly remains unfulfilled. Despite my flirtation with Eclipse, I’m now back with Emacs and will probably stay there unless I do something Java-related. Eclipse is just too bulky and all-encompassing – my mentality is starting to drift back towards the Unix-y toolset approach. (Yes, I just used Emacs as an example of a tool that isn’t bulky. Shut up.)
• In-progress: Hello World Sudoku in Go.
• There are at least two dangling promises for follow-up posts: the ongoing review of Effective Java and/or critique of Java itself, which I’ll get around to soon; and The Design of Design, which I’ve stalled in reading again, having been distracted by Good Omens by Terry Pratchett and Neil Gaiman, because, as mentioned, it’s by Terry Pratchett and Neil Gaiman. I mean, come on.

I’m the only Google hit for “encapsulecurity”.

I said at the end of my sort-of review of Effective Java that a few things bugged me while reading it, not about the book, but about Java itself. These aren’t totally well-formed in my head, so I’m going to try to write them down in an attempt to get them to make sense. This may or may not work. Stay with me here.

I’m going to flick through the book to refresh my memory of stuff, so my thoughts will roughly follow the same order as the book, if you want to follow along.

Ah, here we go. A recommendation from chapter 2 (and the first itemised piece of advice in the book).

Item 1: Consider static factory methods instead of constructors

The gist of this is that constructors have some drawbacks. To name a few: they don’t have descriptive names; they always create a new object, where you might want to reuse an existing one; and they’re forced to return an object of that class, where you might want to use a subclass. Wrapping it in a static factory method gives you control over these things, and by making the constructor private or protected you can make the factory method the primary way for an API user to get a new object.

So, good advice. But there’s a little guy in the back of my head (you know the guy) who starts whispering little subversive things at points like this. He’s always yammering on about something, so it’s usually easy to ignore him, and I wasn’t really listening to him when I was only up to chapter 2… but by the time I was halfway through the book he’d said sensible things enough times in a row that I sort of started paying attention. Anyway, here’s what he said here:

Shouldn’t a language feature called a constructor support the ways that someone might want to construct an object? Why are we being advised to work around it?

Now, look, there are plenty flaws in that argument – the advice is that you consider using it where appropriate, not that constructors are always bad; and nowhere is it written that a language feature has to be usable from anywhere in its raw form for it to be useful. So the little guy hasn’t scored any points yet.

But keep this in mind. Later on (if I stay interested enough in the topic to keep writing about it) we’ll come back to why the little guy’s point was deeper than I realised at the time.

Okay, moving on. The next Item is about using an intermediate builder object when there are a lot of constructor parameters, especially if some of them are optional. There’s a comment in this section that I want to quote because it sort of sums up what my poorly-structured rant is about, albeit bluntly, and from a slightly different direction.

The Builder pattern simulates named optional parameters as found in Ada and Python.

And, I’ll add, most Lisp dialects, C#, Scala and, of all things, Visual Basic. Oh, and recent versions of Fortran. (Cheers to Rosetta Code. Also: there are recent versions of Fortran?) I’m not arguing with Bloch here – it’s good advice for writing Java – but if you have to write boilerplate to simulate what other languages give you for free, it might be a hint that the programmer is doing work that really lies in the bailiwick of the compiler.

I’ve clocked slightly more hours writing Java than Python, but the Python hours are more recent. Reading this made me think about closing the book and swearing allegiance to Python. (Apart from the performance problems and lack of type safety. Oh, and I wasn’t reading it with the intent of converting. I was just trying to stay up to date. Seriously. Guido, I’d never leave you.)

I’ll leave it there – only two Items into the book – but to give you an idea of where the rant is heading, here’s a short talk by Rob Pike about Go.

Here’s my ten-word review of Joshua Bloch’s Effective Java: If You Write Java, You Need To Read This Book.

I wanted to say that up front, because I’m about to talk at great length about one of its shortcomings, which would give the impression, purely by wordcount, that I don’t think it’s a good book. This is just a reflection of how many more words it takes to explain a negative point than a positive one. The book is irrefutably useful and you should read it (if you write Java).

To give the issue a bit of context, here’s a fact that I was only dimly aware of before doing some mid-reading research:

If you get the security settings right, the Java Virtual Machine guarantees access control.

If you declare a field private, and you’re running a trusted JVM, and the security manager is set to disallow JNI and changing accessibility through reflection and a handful of other things, then you can run untrusted third-party code in the same process and even pass those objects to the untrusted code and it will never be able to get at the private field.

This is such a big deal that I don’t understand why it isn’t a bigger deal. It’d be impossible to make this kind of claim in a natively compiled language, because you can always pointer-arithmetic your way to the private data. Python makes only the vaguest of gestures in the direction of information hiding, and certainly doesn’t guarantee it. Maybe C# and the rest of the .NET family make some guarantees, I’m not sure (although whether you’d trust Microsoft to get the security right is a different story (but then, the same question should be asked of Sun Oracle)).

Here’s the issue though. This means that access control in Java actually has two different (although overlapping) purposes: encapsulation, and security. And they’re not the same thing.

Encapsulation is about reducing the complexity and increasing the abstraction of classes by hiding their implementation. Security is about stopping people from seeing or changing data that they shouldn’t be able to. Security is for protecting users from malicious programmers; encapsulation is for protecting programmers from themselves.

Security at this level isn’t always possible. If you’re writing a library for other people to use in a JVM that they control, you can’t expect to hide anything from them – they can turn the security manager way down, or change your bytecode, or run a modified JVM. (At university we had an assignment that involved black-box testing of algorithms that we were given as obfuscated JARs. I worked out that you could peek at some of the internals by rebuilding the Java standard libraries with String declared non-final, and passing in a subclass with some instrumentation added. And no, I didn’t actually do it.)

Most times that someone compromises their own system, they can only do damage to themselves. Of course, you probably still want to make your library as tight as possible so that it isn’t a security hole for other code that it interacts with. The point is that it can be dangerous, or at least an unnecessary programming burden, to rely on language guarantees for security if you’re not always going to have control of the platform.

On the other side, encapsulation isn’t always desirable. Well, maybe it is. There’s heated debate about this. Some people (many of them Java devotees) argue that programmers will find and use every available undocumented feature, and anything you inadvertently expose will doom you to support it forever. Others (e.g. a high proportion of Python fans) say that an API is as much a social contract as a technical one, and that if someone wants to work around an interface that doesn’t meet their needs then, well, we’re all adults, and they’re welcome to do so as long as they accept the consequences if the implementation changes.

The point is that encapsulation and security are different requirements. Making a field private because it’s an implementation detail is one decision; making a field private because using it would open a security hole is a very different decision. If you try to squeeze the concepts into one then at some point you’re going to make a poor decision. And now we get to my one (and minor) gripe with Effective Java: it doesn’t do enough to distinguish between them.

Some of Bloch’s points (e.g. Item 10: Always override toString) are clearly about programmer-friendly abstractions. Other points (Item 76: Write readObject methods defensively) are clearly about security – no programmer would (or could, reliably) exploit it just to get around API restrictions. In one place (Item 39: Make defensive copies when needed) he mentions that a particular security measure has a big enough performance hit that it can be valid to leave it open, if it’s in an environment where misuse will only hurt the (mis)user. But in other places it’s not so clear exactly what kind of advice he’s giving, which could lead readers to apply the advice in the wrong way.

Part of this might be that Bloch is writing from the perspective of someone who worked on the Java platform APIs, which sit in the part of the Venn diagram where encapsulation and security do overlap: they’re widely used, so any leaky implementation details are guaranteed to become a compatibility issue; and they’re the basis for every other API (even a trivial class extends Object) and available to malicious code even on a trusted JVM, which effectively makes them part of the platform’s security guarantee. And I suppose you could argue (indeed, he says something similar to this in the introduction) that you don’t always know where your code will end up, so aiming for as much encapsulecurity as possible isn’t a bad thing.

And frankly that’s a pretty good argument. Which is why you still need to read this book.

(A few other things bugged me while reading it, but most of them were directed at Java rather than the book itself. There might still be another post or two in this topic.)

Am I the only one who didn’t know about this?

#include <stdlib.h>
#include <stdio.h>
#include <limits.h>

int main(int argc, char **argv)
{
    printf("%d\n", abs(INT_MIN));
    return 0;
}

Which gives:

davemc@zaphod:~/devel$ gcc -o abstest abstest.c
davemc@zaphod:~/devel$ ./abstest
-2147483648

The abs function, in C, is undefined if you call it with INT_MIN (because a two’s-compliment 32-bit int can be -2³¹ but not +2³¹). In Java, it’s specified to return Integer.MIN_VALUE.

I feel slightly betrayed that abs can return a negative number. Actually, I feel more betrayed that this isn’t a classic drummed-into-our-heads-in-every-programming-guide-and-uni-course-ever gotcha.

In other news: Google doesn’t do what you expect if you search for “man abs”.

https://www.microsoft.com/protect/fraud/passwords/checker.aspx

We don’t always talk about who comes up with what behind the scenes for Darths & Droids – and in fact I haven’t been as involved in writing lately anyway – but I do feel the need to claim credit accept blame for the atrocious pun in strip 475. (Click here to ruin the joke.)

According to our wiki, I suggested it on March 11, 2008. So the guys have had over 2½ years to veto it. I consider that a failure on their part.

It’s been about six years now since the last time I had a job that involved writing Java. Since then I’ve pulled it out occasionally for toy projects, but that role has been taken over lately by Python (although not for anything heavily numerical).

In the last couple of weeks I’ve started playing around with it again, for a confluence (pun partially intended) of minor reasons:

• Android. When I got my HTC Hero last year, I’d always planned to dabble in app development, but never got around to it. Now that Tina has a Samsung Galaxy S (a genuinely awe-inspiring phone, by the way), it’s become interesting again; that, and I actually have an idea for a project (more on that later).
• When I started looking into Lisp, I read a bit about Clojure, a Lisp dialect that compiles to the JVM. At the time, it seemed like a bit of a fringe project, albeit a cool one. Now that I’ve gone through the Common Lisp thing and concluded that its biggest problem is the available compilers, a more modern take on a well-supported platform with solid standard libraries is starting to sound appealling.
• Other stuff that I won’t talk about yet. Ssshhhh!!!

This year I intend to learn to use Emacs properly. I’ve always liked Emacs in principle but never really been able to remember the arcane command sequences to do anything beyond undo, search/replace, and some basic navigation and file stuff. This is the year to jump down the rabbit hole.

A backup resolution, in case the rabbit hole turns out to stink, is to switch to vi.