Typical Programming

Elio Grieco

11-June-2025

Where

Talk given at Rust <> Security , Wed, Jun 11, 2025, 7:00 PM session of the Desert Rust Meetup.

Slides available at: https://eliogrieco.com/typical-programming/

Typical Programming

NewType and TypeState patterns in Rust

Inspired by:

  • Stephan Edwards talk at CactusCon many years ago.
  • More recently by David Koontz and the Functional First Phoenix meetup.
  • Currently working with Michael Gilbert on the Symplasma project.

What is coding?

  • Understanding a problem
  • Theory building (Naur)
  • Managing complexity
  • Describing the solution in enough detail for a computer to execute the task

Why does this matter

What are bugs?

Bugs or software defects come in 3 main flavors:

  • Syntax Errors: Easy to catch
  • Semantic Errors: Preventable with the correct techniques
  • Logic Errors: Time to really rethink what you are doing

Gotta Catch ’em All

  • Catch bugs as early as possible
  • More ergonomic for end users of libraries: make usage errors fail at compile time
  • making invalid states unpresentable
  • If you’re really serious use Formal Methods or Correct by Construction?

Why

“Fools ignore complexity. Pragmatists suffer it. Some can avoid it. Geniuses remove it.”

—Alan Perlis

Weird Machines

Failing to manage complexity leads to bugs and security issues by introducing Weird Machine behavior.

We have more than enough of those already…

Looks can be Deceiving

Hidden complexity can be a lethal danger.

Bolton Strid

Bolton Strid

What appears to be a small stream one could easily jump across hides unfathomable depths of around 65 meters.

Managing Complexity

So let’s put in some guardrails.

This way we can still work with complexity but appreciate it in a safe way.

Grand Canyon Mather Point
Grand Canyon Skywalk

NewType

Integrating the security model

We can integrate the security model directly into the code. This makes it very difficult for devs to miss something or to misuse a value.

authenticate(name: String, pass: String);

authenticate(name: UserName, pass: Password);

TypeState

  • Make it impossible to call methods on objects in the wrong state
  • Enforce valid state transitions: enforce correct state machine logic in the type system

Enforcing correct order of operations

MAC then Encrypt or Encrypt then Mac?

We can enforce correct transitions to ensure that people don’t compose operations in dangerous ways.

Demo

eunicode: A text processing CLI and library that helps sanitize text by removing the naughty bits to make strings good and safe.

Proper Dev Mindset

There are many other approaches to ensureing safety, reliability, correctness, and security in code.

“I use these techniques and languages, not because I’m a genius, but because I’m smart enough to know that I can’t write high quality software without them.”

— David Koontz

Going further

So where do we go from here?

Are there more patterns and tools to manage complexity?