High Assurance Software: A Practical Overview

Transcript

1. High  Assurance  So0ware:  A  Prac4cal  Overview   July  15,  2015  –  Chicago  Lambda  Jam   Jus4n  Leitgeb   @jus4nleitgeb  
2. Overview   •  Origins  of  this  talk   •  Defini4ons  of  high  assurance,  and  focus  of   this  talk   •  Philosophy   •  Types,  from  Haskell  to  Ur  to  Coq   •  Conclusions  
3. Origins  of  this  Talk   •  Wri4ng  so0ware  in  Ruby  for  the  last  9  years,   and  more  recently,  working  on  projects  sin   Haskell   •  2012  Talk  at  GoRuCo  on,  "Sensible  Tes4ng"   •  2015  OPLSS  on,  "Types,  Logic,  Seman4cs,  and   Verifica4on"  
4. Founda4ons  of  High  Assurance   Accord  is  Built  on   Verifica2on,  Not  Trust,   Obama  Says     NY  Times,  July  14,  2015   [4]   h\ps://commons.wikimedia.org/wiki/File:Poster-­‐ sized_portrait_of_Barack_Obama.jpg  
5. Narrowing  our  Focus   •  Not  talking  about  DoD-­‐level  security.   •  Rather,  scope  is  more  mid-­‐large  size,  web-­‐ based  applica4ons.   •  Achieving  "high  assurance"  is  something  we   should  all  be  concerned  with  in  so0ware!  
6. Defining  High  Assurance   •  "High  assurance  development  means   producing  compelling  evidence  that  a  system   meets  specified  requirements."  [1]   •  Acceptably  high  assurance  based  on   assessment  of  risks.  
7. Tests?   •  Part  of  the  solu4on,  since  they  provide   evidence  that  a  system  is  working,  easy  to   verify  by  an  outside  party.   •  Property-­‐based  tests  be\er  than  unit  tests.  
8. A  philosophical  digression   "Civiliza4on  advances  by  expanding  the  number   of  important  opera4ons  which  we  can  perform   without  thinking  about  them."       -­‐  Alfred  North  Whitehead  
9. The  Triumph  of   Types     Robert  Constable  
10. Types   •  What  are  types?   •  What  implementa4ons  of  useful  type  systems   do  we  have  now,  and  what  might  we  have  in   the  future?  
11. What  are  types?   •  "…  method  for  proving  the  absence  of  certain   program  behaviors…"  [6]   •  "Sta4c  type  systems  are  the  world's  most   successful  applica4on  of  formal  methods."  [7]   •  Proposi4ons!  
12. Curry-­‐Howard,  or,   Proposi2ons  as  Types   •  For  each  proposi4on  in  the  logic,  there  is  a   corresponding  type   •  For  each  proof  of  a  given  proposi4on,  there  is  a   program  of  the  corresponding  type   •  For  each  way  to  simplify  a  proof,  there  is  a   corresponding  way  to  evaluate  a  program   From  Proposi4ons  as  Types,  by  Philip  Wadler  [10]  
13. Our  experience  with  Haskell  
14. Increasing  Type  System  Expressiveness   •  Scalar  types   •  Algebraic  Data  Types   •  Kinds   •  Dependent  Types     See  Types  and  Programming  Languages  [6].  
15. Scalar  Types   Integer,  String,  Etc.  
16. Algebraic  Data  Types   •  Tuples,  Record  types   •  Sum  Types   •  Analyzed  with  pa\ern  matching    
17. Algebraic  Data  Types:  Example   h\ps://en.wikipedia.org/wiki/Algebraic_data_type  
18. Kinds   •  The  type  of  a  type  constructor     h\ps://wiki.haskell.org/Kind  
19. Dependent  Types   •  Idea  that  programs  can  be  "correct  by   construc4on"   •  Can  be  a  double-­‐edged  sword     •  Found  in  Idris,  Agda,  Coq…  but  also  Haskell!   See:  Types  and  Programming  Languages  [6]  
20. Approaching  Dependent  Types  in   Haskell   •  Liquid  Haskell  (talk  @  1:20  today  by  Ranjit   Jhala)   •  Stephane  Weirich's  work    
21. Our  prac4cal,  typed  programming   experience  @Stack  Builders   •  Programs  we  would  have  thrown  out  in  Ruby  give   us  a  great  star4ng  point  for  refactoring  in  Haskell.   •  Algebraic  data  types  give  us  a  good  idea  of  the   program  domain.   •  Goal  is  finding  a  "sweet  spot"  of  enough   assurance  offered  by  type  system,  while  not   inducing  costs  that  are  too  high  –  Haskell  fits  the   bill  for  us  right  now.    
22. Gaining  more  assurance:  Ur/Web   •  Ur/Web  is  a  DSL  for   web  programming   •  Includes  dependent   types   •  Well-­‐typed  programs   do  not  go  wrong,  "in  a   broad  sense"    
23. Well-­‐typed  Ur/Web  programs  will  not:   •  Suffer  from  any  kinds  of  code-­‐ injec4on  a\acks   •  Return  invalid  HTML   •  Contain  dead  intra-­‐applica4on   links   •  Have  mismatches  between  HTML   forms  and  the  fields  expected  by   their  handlers   •  Include  client-­‐side  code  that   makes  incorrect  assump4ons   about  the  "AJAX"-­‐style  services   that  the  remote  web  server   provides   •  A\empt  invalid  SQL  queries     h\p://plv.csail.mit.edu/ur/  
24. Produc4on  Sites  in  Ur   •  BazQux  Reader   •  Bitparking  Namecoin  Exchange  (defunct)   •  Bitcoin  Merge  Mining  Pool  (defunct)   From  Ur/Web:  A  Simple  Model  for  Programming  the  Web  [3]  
25. More  Dependent  Types  with  Coq   "Wri4ng  formal  proofs  is  hard,  so  we  want  to   avoid  it  as  far  as  possible.  Dependent  types  are   invaluable  for  this  purpose."     From  Cer4fied  Programming  with  Dependent  Types  by  Adam  Chlipala  [2]  
26. Conclusion   •  No  silver  bullet  for  high  assurance.   •  We  should  all  be  thinking  about  verifica4on  –   evidence  our  systems  work.   •  We  should  think  of  types  (before?)  tests!   •  Has  implica4ons  for  agility  of  a  so0ware   system,  not  just  life-­‐or-­‐death  applica4ons.  
27. References  and  Further  Reading   1.  Burke,  D.,  Hurd  J.,  Tomb  A.  High  Assurance  So0ware  Development,  Galois  Inc.  Retrieved  July  7,  2015   from  Galois:  h\p://code.galois.com/paper/2010/HighAssuranceSo0wareDevelopment.pdf   2.  Chlipala,  A.  Cer4fied  Programming  with  Dependent  Types   3.  Chlipala,  A.  Ur/Web:  A  Simple  Model  for  Programming  the  Web,  Retrieved  July  7,  2015  from  Adam   Chlipala's  web  site:  h\p://adam.chlipala.net/papers/UrWebPOPL15/UrWebPOPL15.pdf   4.  Chlipala,  A.  Ur:  Sta4cally-­‐Typed  Metaprogramming  with  Type-­‐Level  Record  Computa4on,  Retrieved  July   7,  2015  from  Adam  Chlipala's  web  site:  h\p://adam.chlipala.net/papers/UrPLDI10/UrPLDI10.pdf   5.  Constable,  R.  The  Triumph  of  Types   6.  Pierce,  B.  Types  and  Programming  Languages,  The  MIT  Press,  2002   7.  Yorgey,  B.,  Weirich  S.,  et.  Al.,  Giving  Haskell  a  Promo4on   8.  OPLSS  2015   9.  Sanger,  D.  Gordon,  R.  Iran  and  6  World  Powers  Reach  Deal  to  Curb  its  Nuclear  Plans.  Retrieved  July  14,   2015  from  the  NY  Times   10.  Wadler,  P.  Proposi4ons  as  Types.  Version  V10,  November  2014  
28. Thank  you!   Jus4n  Leitgeb   jus4n@stackbuilders.com   @jus4nleitgeb