Atlas · Details
Parabola
Author’s note
A short story from 2006 that I completely forgot about writing until I put this website together, twenty years later. It has exactly one plot twist, so... not much of a story. But I sure was angry about how crummy Java was back then.
Don't read the AI notes if you don't want spoilers.
AI Notes
A short story arguing a point about type safety. The guard at the
airport security gate is named T.S. — Type Safety —
and he's spent twenty-two years memorizing a thick blue rulebook that
grew, special case by special case, every time a desperate passenger
found a hole in it. A frantic woman named Anushri rushes up with a
handwritten note from the ticket counter: her husband is in the E.R.,
the Red Cross has put her on the flight that boards in ten minutes.
T.S. doesn't take the note — handwritten notes aren't credentials.
The other passengers in the queue turn out to be programmers, and they start trying to help
the only way they know: have you tried the debugger? A back port?
Reflection? Just rebooting? Anushri interrogates T.S.'s interface
— checkCredentials, denyAccess, getVersionString… — looking
for a unit-test hook, a substitution point, any seam she can pry open.
There isn't one. T.S. is a production system without a test API. They
solve it in the end by disassembling the entire caterpillar and
stepping out of the line, so the gate has nothing to refuse her at.
The same argument as Execution in the Kingdom of Nouns and Is Weak Typing Strong Enough?, recast as a short story. Its point: the only way past a strongly-typed system that wasn't designed for your case is to redesign the call site around it.
Related listings
-
2006
Execution in the Kingdom of Nouns
The other 2006 piece making the same case against Java's noun-heavy world, but as straight allegory rather than parable. Read together: Kingdom of Nouns describes the country; Parabola shows a single afternoon inside it.
-
2005
Is Weak Typing Strong Enough?
Steve's argument-form essay on the same theme a year earlier — duck typing versus strict static typing. Parabola is what happens when the argument grows up and decides to tell a story instead.
-
2008
Dynamic Languages Strike Back
The Stanford talk where Steve made the public case for dynamic languages two years after this parable was written. T.S. the security guard is the cartoon version of every argument in the talk.
From the peanut gallery
Read the rest of the thread · 46 more
-
That was awesome. Thanks for coming up with it.
-
I theorize that there was something about this blog that was supposed to tell me something non-completely-obvious about programming (Otherwise, why the programming references?). However, I have no idea what it was. I hereby submit a request for enlightenment to the world at large.
-
Gary: Brilliant! I now love this blog entry.
-
Nice well-written story, but geez, having written so much, you could have at least related it to the point you were trying to make. Sorry if I sound ignorant, but I think you do owe it to your readers who may not necessarily be in the same frame of mind as you are.
Halfway through the story, I was almost sure that you were going to talk about rigid organizational processes when suddenly the characters started talking about programming. -
Krishna:
Um, how are those not one in the same in this instance?
Type safety is a kind of organizational rigidity. -
notheory: It's the paradigm shift that jars the reader. If the organizational rigidity metaphor had been maintained consistently, the story would have flowed holistically and been open to any type of interpretation about such ideas.
I'll forgive it, though, because those who read this blog know that Steve is a programmer, and are likely programmers themselves. As such, the paradigm shift can be viewed as a substitute for a more succinct conclusion concerning the topic at hand.
Personally, though, I just liked the story when I thought its focus was the lunacy of airport "security." -
Great story - brilliantly written and well-paced. Also, very convincing appeal for more supple systems.
Now, we need another post with a functional, higher-order, dynamic security guard that likes curry. -
What you've not noticed is that because of weak typing some of the existing caterpillar are in fact caterpillars. There are a few elephants too, a maternally enraged gorilla, a dachsund named Colin and a Queen Anne table.
Unfortunately not all of them are able to agree to step aside. Particularly the gorilla which has a distinctly belligerent side.
Oh yes, I nicked this straight from Blackadder
Oxbow Lakes -
So you think that Type Safety stands in the way? An that non-strictly typed languages à la JavaScript are more flexible?
Have you ever tried to stay in line and get your turn in India? -
So, I understand that this is supposed to be a critique of type systems, but I'm not sure it works as written. In what way were the woman and her son incorrectly typed? Or is the point that Mr. T.S. couldn't handle authentication of various types? In any case, the (admittedly rather clever) solution doesn't involve type hacking at all.
-
Their "line pass" should be sufficient because it's from the right people and place, but it doesn't have the correct type. Maybe the LinePassFactory at the counter jammed, or whatever, but their just aren't any more of the objects.
One of the underlying problems is that the guard expects a type (LinePass) which is tied to an implementation (LinePass) which is not always available. It probably could have been fixed by supporting an ILinePass interface with a generalized authentication model, rather than just a LinePass class, so that you could have an EmergencyLinePass class (Factory) for such situations. But you would have to think of the LinePassFactory jamming to get that to happen.
Of course, if you ask me, that makes the situation more ridiculous, not less. -
Well this was fantastic. Inputting programming terminology and methods into real world situations, without warning, was jarring in the best way possible.
I also love that the only way to really get around Type Safety was by a massive effort of human leadership and sacrifice. A little over the top, maybe, but I love the tone. This was really good. -
I really enjoyed the parallel of some of our inane programming rules to real-world inanity.
When you consider some of Steve's other rants about how the human mind works you realize his belief is that neither has to be so.
Or does it? I watched the first third of "What Bleep Do We Know" last night (http://www.whatthebleep.com/) and wonder if our minds require such structure. -
That was a really interesting read. It reminded me a bit of the parable of the managers < http://hestia.typepad.com/flatlander/2005/05/the_parable_of_.html >
-
I'd have thought the allegory referred to single threaded transaction servers (TS) which processes two queues FIFO (ordinary queue and priority queue).
The priority queue was not designed for this special case. As the TS code is proprietary and could not be changed, the only other way to get around the problem is to hack the ordinary queue instead so that the urgent case could pass through.
Type safety kicked in here when it turns out that ordinary passengers couldn't be provided with a priority credential. The TS was probably sending people based on their credentials (type) instead of a priority. There were no bypass flags supplied. -
This metaphor could also be applied to Net Neutrality. Imagine T.S. is instead N.N., and Anushri is pleading for her husband's medical records to get to his surgeon. The people in line represent YouTube viewers, MMORPG players, etc.
BTW, Stevey, too many notes with this one :) -
You really need to work on being more concise in your writing style.
-
Please ignore the advice of "Alex" above.
-
I agree with Gary Bernhardt's interpretation of it being an allegory for type safety; however both the story and his comment were running through my head all night, so I've written Parabola Redux - a follow-on where T.S. has been replaced with D.T..
-
Anyone got any ideas what the title of the post was about? Wordplay on 'parable'? And is there any significance in the names mentioned (other than T.S., clearly)?
-
Actually although Anushri walked like a nice lady, and talked like a nice lady, she was in fact a Pakistani terroist. She had been taught that security queue overflow exploit at the terroist training camp she attended last summer, along with a way to get into the back door of the cockpit. The plane crashed somewhere over Ohio.
-
The programmer references were good.. I was more impressed with the easy flow of the narrative... I never thought I'd make it through the long article (judging from the size of my scroll-bar handle!) but it was hard to hit the back button!
Nice twist on the programming metaphor!
Have bookmarked your blog!
Thanks
Pankaj -
This post is a good followup to Execution in the Kingdom of Nouns.
Java's type system is based on the OO concept that you are trying to model real-world things, so things have precedence over actions. Now push the metaphor back the other way.
Instead of trying to make a programming language mimic real life, examine how real life would look if it worked like Java. If you find yourself frustrated, pissed off, and thinking, "Man, that just makes no sense," you'll see how Steve feels about Java, and static type systems in general. -
This is incredibly well written. We really need more people who can write like this in our industry. Wish I were one of them.
However, assuming the author is arguing against type safety, I think it would had been much more effective if he had not used the airport security line for the metaphor. You see, I think T.S. did absolutely the right thing. Both metaphorically and literally. Who's to say Anushri is not a terrorist? She sounds convincing, but I see nothing of substance... a handwritten note? a sad story? Ok, the child does lend some credibility, but considering the stakes, I still say, no dice.
Like computer systems, airport security personnel really should not be making judgment calls based on heuristics. Especially when the stakes are high.
Maybe the argument is subtly _for_ type safety?
Maybe I missed the point. I'm new to this whole anti-typesafety concept. Please feel free to enlighten me. -
Sorry, Matt, but you just tweaked one of my pet peaves. If this comes off as excessive, please realize it's not all directed at you.
I'm really tired of the idea that any rules purporting to protect us are unquestionable. Most of what's happening in airport security is more show than susbstance.
In this specific example, the woman wasn't even asking to bypass a security check, just to bypass the line at the security check.
Are we really such slaves to our fear that we aren't willing to make exceptions for exceptional circumstances? Is any behavior or policy in the name of safety now acceptable, even if it is neither reasonable nor effective?
[pant pant pant ...]
Back on topic, that was definitely intended to be against type safety. The supposed benefit of type safety is that it ensures your input will match the conditions you're anticipated. The down side is that sometimes there really is input you need to handle for a condition you didn't anticipate.
This post was a really good example of how people routinely hack around these constraints, like Gary Bernhardt said above. -
Seasons Greetings,
If such *keepers are expected to be professional and not just technical, they should listen to David Maister's Real Professionalism
Cheers, Kishore. -
Hi d,
Thanks for the comment. I was referred to this article by a friend and really want to understand this position.
This statement from your comment preplexes me: sometimes there really is input you need to handle for a condition you didn't anticipate.
I don't see how software could possibly attempt to handle anything it did not anticipate, except to gracefully fail, which T.S. did. It would seem you would need to make some basic assumptions about an object or information you were presented with and these assumptions could be embedded in to a type hierarchy(the rulebook ).
Tying it back to the allegory, I guess where I struggle is with the implied need for a more benevolent and empathetic gatekeeper that can be flexible to any situation and do the right thing. I could be convinced this is important (and maybe even possible) for human interactions, but I don’t get how a computer can implement this in software. Anushri successfully won the crowd over by revealing some extreme circumstances. However she was only successful because they had context in their own internal “rule book” that allowed Anushri to communicate her needs to them. What if they did not know what a husband was? What if no one spoke English?
I’m really not trying to be ridiculous. I bring up these points just to demonstrate that I see most interchanges as needing shared context. Without that shared context, we don’t communicate. It doesn’t matter if we are humans or software. In software it seems to simplify things immensely if that shared context is explicit in the interface vs. implicit in the code behind the interface.
So I guess I would ask, how does a loosely typed software system use data that it did not anticipate to make decisions?
Note: I really feel like I might be missing the point of this, so if anyone wants to redirect this to what I really should be understanding from this post, please do so. -
Matt, the closest I can come to an explanation is to ask what type do you use for input variables to a polymorphic function?
I've worked exclusively with loosely-typed languages. All the code I've looked at that had to deal with explicit casts looks nasty to me. But as with anything else, you have to really know something to really hate it. Someone else can probably give much better examples than I can. -
Brilliant, absolutely brilliant!
-
I just wrote a little blog post on "why dynamic typing is useful", inspired by Matt & friends. For those who haven't had much exposure to dynamic typing, it might help to tie the ideas in the story to static vs. dynamic typing.
-
Ha ha, I love it.
When I got to the part were she says "is anyone here a programmer", it felt like I had been bel-air-ed. -
great stuff, totally surprised me with the programmer references toward the end (should I have expected anything else?), but...she should have written a quick security shim using a facade pattern, exploited the java container with out-of-bounds exception and a pointer to her own security key. But maybe I simplify.
...dave
the C++ team -
Andrew, any Passenger can actually be Terrorist as Terrorist is just a subclass from Passenger who has overridden the method "sitOnPlane" and super calls that function, but once in the air it calls it own private method "pushRedButton".
Dave, creating a facade is good when you know all situations, but you can't always foresee everything. Say a car without wheels is developed. it will normally fit into any old parking lot, what you're saying is rewrite parking lot to change something that could perfectly fit the new situation without changes if only the guard wasn't so stubborn. I personally would just want another guard. -
Brilliant. And glad to see life has eased up enough so you can continue blogging. Getting Wyvern back up and runnign wouldn't be bad either :-)
-
I'm looking forward to steve's "Salmon on the Mound"... blessed are the geeks for they shall inherit multiply...
I find the endless debates about language features to be rather silly. They all have their advantages and disadvantages. If you have a choice of language for a project, you choose the one best-suited to what you're working on. If you don't have a choice, you work around the disadvantages. Polymorphism and loosely-coupled challenge/response interactions could allow for bypassing existing checks, or otherwise delegating functionality that allows a system the flexibility needed to handle situations for which it was not originally designed. I'd love to see a parallel universe recitation of this story showing how it would work "better" -
After copy/pasteing this article to http://www.bookblog.net/gender/genie.html, it gives:
Female Score: 5347
Male Score: 5043
The Gender Genie thinks the author of this passage is: female!
wow, that was a surprise! -
Del.icio.us metadata for this rant:
programming, SteveY, excellent, yummy, voluptuous, rants, AMZN, 10{100}, Java, spirituality, self/reflection, introspection, perl, terseness, LISP, masochism, sadism, absolute, power, Architect, Matrix, Paul Graham, typing, type safety, strong, weak, ruby, racism, xenophobia, nationalism, bureaucracy, boredom, mediocrity, psychology, optimism, pesimism, generosity, contempt, freeloading, theory, priority, queueing, QoS, network, neutrality
,telco, content, monopoly, slippery, slope, potential, abuse, abridgment, speech, freedom, first, amendment, MILF, rotating, advertisement, popular, websites, feature, author, language, NLP, wordsmith, independent, thinker, Chomsky, Dershowitz, intelligence, intellect, CIA, good, shepherd, skulls, bones, politics, fraternity, California, war, peace, oil, addiction, W, butter, knife, not, funny, hilarious, brilliant
Can you digg it?
Designed to confuse. Wonder how much time he spent writing it? -
---
kathy said...
Say a car without wheels is developed. it will normally fit into any old parking lot, what you're saying is rewrite parking lot to change something that could perfectly fit the new situation without changes if only the guard wasn't so stubborn. I personally would just want another guard.
---
I would fire the one who made up the rules for this guard. Correctly done, it would accept any vehicle with the right dimensions. A vehicle, so I know it has the need to park and be able to move to the lot. And the right dimensions so I know it would actually fit in it.
The only things I can see go wrong can only be handled by the rules maker, not the language afaik. Then I think about limos requesting 2 parking lots, conspiracy lovers who don't want to tell their dimensions, etc.
About Parabola, the problem here is not: "Is this person allowed to pass?", but: "Who can go next towards security check?". Anushri is not allowed in the priority queue, because the queue, managed by T.S., does not recognize the reason as valid.
If the machine is broken (or ran out of passes), it's not the fault of T.S. T.S. requires some form of defined pass.
I'll try to write the happenings of Parabola in 'pseudo' code:
//priority reason confirmed
try {
setHasPriority()
} catch (RunOutOfBooleansException) {
prepareExcuses()
hopeForTheBest()
}
PriorityQueue.acceptMePlease()
while (!insidePriorityQueue) {
BegSome()
PriorityQueue.acceptMePlease()
}
now what happens next, is that the priority queue declines continuesly. And this passenger keeps looping, begging and trying anyway.
At some point the other passengers notice the requests for the priority queue gets declined continually. At that moment they check the priority reason of this unlucky passenger and decide themselves to step aside. Also the loop of the unlucky gets altered to this:
while (!insidePriorityQueue && !insideNormalQueue) {
BegSome()
PriorityQueue.acceptMePlease()
if(normalQueueIsEmpty)
NormalQueue.enter();
}
For me this story is not about static/dynamic typing.
It's about static/dynamic logic. And as of yet there's no snake nor gem that does that. -
A vehicle with the right dimensions could be a boat, I don't want a boat in my parking lot. I'm talking about a complete new vehicle type.
-
I have no experience with dynamic typing, so please let me know how it would let the parking lot allow this new car-without-wheels, while still denying boats or the not yet invented boat-without-hull?
-
@sobani:
It wouldn't. You could also park a string in the parking lot, or an integer. Or a flying spaghetti monster.
@original post:
Why, in the name of all that is holy, should we solve this problem by changing the implementation of the Guard? If the guard would have been designed correctly to begin with, altering its behavior would not be an issue -- static or dynamic typing aside. Software should be designed to limit the impact of changing requirements. The last thing that I want to do is to have to hack up existing source when changes occur. That's one sure fire way to creating a Big Ball of Mud.
The REAL problem is that the interface that a given software component exposes should match the absolute minimum required for its implementation. Consider C#, for example... if you have a method that accepts a List<T> as a parameter, but all you're doing internally is iterating through it and visiting each member in some way, your method your really accept an IEnumerable<T>. Accepting a generic object as a parameter does NOT improve the design, because I could pass in a string, or an integer, or a FooBarBaz and my method would fail at runtime. Isn't it better to indicate what the method expects at design time?
Design is a result of the developer, not the language or the compiler. -
@Nate
You don't always have control over everything in the design, sometime you're bound by library modules that needs a specific class. But if you're bound by single inheritance you need to hack your way into the library module and that creates nasty code. dynamic typing does not have this problem, but on the other hand it's easier to build messy code with dynamic typing.
It's mostly personal preference. But sometimes you just want to be able turn TS off for a while, specially when it keeps the code clearer and the programmer knows what he's doing. Too bad that when you can do it, it will be abused. It would be a neat feature. -
The suggestion that javascript is superior to java for writing a well designed API is simply hilarious. You are kidding aren't you?
This story is nothing but emotional crud. Yep, we all hate airport security... T.S. is like airport security... thus we all hate T.S. The greek philosophers would be turning in their graves. -
I thought I'm reading about the current airport security policy, until the dark haired lady asked the captive audience.
Nice story though. You should write a book. -
A brilliant piece of literature.
The comments are also a good example of how we (read programmers) think.....
-Manoj -
Nice story...
Elliot, T.S. is type safety. The system in the story is statically and strongly typed, and it can only handle the situations that its designers anticipated. The users have to hack around its type safety to handle real-world situations (like breaking up the entire queue to let one item pass).
(Apologies to Steve and everyone else if I'm just totally confused. :)
— Gary Bernhardt · 8:22 PM, December 19, 2006
T.S. is not universal Type Safety, but instead "Type Safety in Java". Yes, Java has a weak and rigid type system. Anyone cared to look at a Hindler-Milner based type system?
I postulate that this is a case of Blub.
— Tony Morris · 2:12 AM, December 20, 2006
Does a cockpit have a "back door"? As far as I can tell, it just has a "door."
— Ian · 9:47 AM, December 21, 2006