Gunnar Kudrjavets

Paranoia is a virtue

Having all the assertions turned on in production code? (Part I)

Let’s start with the fact that I have forgotten most of the mathematics I learnt in university and therefore before going to sleep I’m able to read only non-mathematical books about cryptography like for example "Practical Cryptography" by Niels Ferguson and Bruce Schneier. The book has one chapter called "Implementation Issues (I)" with section "Quality of Code" and subsection named "Assertions" (page 148). It starts with a very pleasant quote:

"When implementing cryptographic code, adopt an attitude of professional paranoia."

As I’ve spent some years before joining the Microsoft on writing some crypto related code for financial institutions I of course wholeheartedly agree with this idea. Later the particular subsection gets even more interesting. Here’s another set of quotes:

"... There are some programmers who implement assertion checking in development, but switch it off when they ship the product. Who thought that up? ...

... Why would anyone ever switch off the assertion checking on production code? That is the only place where you really need it! If an assertion fails in production code, then you have just encountered a programming error. Ignoring the error will most likely result in some kind of wrong answer, because at least one assumption the code makes is wrong. ..."

People who professionally know me are familiar with the fact that my middle name is "Mr. Assertions" ;-) That’s right, G "Mr. Assertions" K. This specific subject is so provoking for me that if I wouldn’t be so wiped out from last couple of days (shipping server software is hard) I would write a long essay based on these quotes, but I have to get some sleep first and wait till tomorrow ;-)

Posted: Apr 27 2004, 09:04 PM by gunnarku | with 5 comment(s)
Filed under:

Comments

Pavel Lebedinsky said:

I think Writing Solid Code has a nice section on assertions.

Of course assertions are not a replacement for argument/return code checking etc. But debug-only assertions are still useful for things that are too costly to do in retail.

Sometimes it might make sense to ship code with assertions and other debugging checks that can be enabled in retail with a registry key etc (like gflags/pageheap). But classic #ifdef _DEBUG assertions still have their place IMO.
# April 28, 2004 1:52 AM

Gunnar Kudrjavets [MSFT] said:

Pavel, you're so right, section “Assert Yourself” in "Writing Solid Code" is fascinating reading! I've found one of the other best references to be John Robbins's "Assert, Assert, Assert, and Assert (page 85) in "Debugging Applications for Microsoft® .NET and Microsoft Windows®". John Robbins just rules.
# April 28, 2004 2:01 AM

TrackBack said:

Staffan Malmgren's Blog
# May 17, 2004 7:38 PM

Bob said:

"Writing Solid Code" recommends the
#ifdef DEBUG
...
#endif
so it doesn't advocate shipping assertions,
see pg 14 for argument.
# June 18, 2004 11:36 AM

TrackBack said:

# July 12, 2004 8:22 PM
Leave a Comment

(required) 

(required) 

(optional)

(required)