Somebody posted a reply to my last post about Django’s autoescaping mechanism. (They were too cowardly to post on my site, so they posted it at reddit.com.) The person said something like, "you shouldn’t trust yourself to remember to escape your own variables." Oh, heaven forbid I trust myself to be a good programmer! That really got me thinking about the recent trends towards designing frameworks, APIs, even languages for mediocre programmers. We are sacrificing speed, simplicity and efficiency to make common bugs less common, trying to design away the mistakes inexpensive and poorly-trained computer scientists make.
Now, of course when I say "recent trends," I should acknowledge that this type of thinking has been around for decades. It was first truly popularized with the introduction of Java. Some people forget to free memory, so add garbage collection. Some people forget to bounds-check arrays, so make that automatic. Ooh, pointers are scary! Let’s get rid of them. We can’t allow our outsourced foreign coders direct access to memory!
Good training, along with working for nearly a decade as an embedded software engineer, has taught me good programming habits. I’ve learned to be conscious of memory leaks, to always check return values, to program defensively, to bounds-check. I’ve created software for shipping products in such low-level and "unprotected" languages as C++, C, and even Assembly. I’ve written production code within less than the memory space required for a Java byte-code interpreter. And of course, I’m not alone in this. There is a large subset of software developers who had to learn to program carefully, due to constraints out of their control. These types of good programming habits carry over into whatever platform or language is used.
I feel a lot of the new safety-net style approaches are simply enabling poor programmers to work on increasingly sophisticated projects. To get back to the example from my last post, Django is a wonderful tool. You can program a sophisticated database-centered multi-user web application without even knowing how to spell SQL.
Django’s recent addition of autoescaping, and more importantly, the enabling of autoescaping globally by default, is yet another example of API-design for the lowest common denominator. (I should note that I love Django. It saves me writing a lot of redundant code and provides a lot of things for free that I would otherwise need to write from scratch, so I don’t mean to pick on Django here. It just happened to be the catalyst for this discussion.)
It’s not all bad
I know I’m starting to sound like an old curmudgeon. "In my day, we didn’t have variables, we just had to carry around rocks to count!" I’m not that old, really. And I’m certainly not advocating we go back to the days before garbage collection and bounds checking. Especially given the potential security ramifications of memory-management bugs, these things are especially important. I just want to urge caution before binding developers in a straitjacket. Rather than trying to design away all potential bugs at the level of the language or API, emphasize and facilitate good programming and testing practices. I’ve never once bought a For Dummies book, and I never will. Please don’t force me to use a For Dummies application framework.