Thread by @ScottWlaschin

Recently @Hillelogram linked to Pamela Zave's work on "Feature Interaction" pamelazave.com/faq.html. This is well worth reading and has some nice examples where two features work correctly in isolation, but fail when combined. For example:

Carol has Do Not Disturb enabled except for her colleagues. Later, her colleague Bob starts forwarding all calls to Carol. When Alice (who Carol doesn't know) calls Bob, the call is forwarded to Carol. Should Carol's phone ring?

The "Do Not Disturb" and "Call Forwarding" features both work as designed but their interaction is not obvious. Designing and testing the components individually will not address the problem. You might not even be aware that you have a problem!

Even within one feature, interactions are tricky. E.g. Alice is forwarding to Bob, and Bob is forwarding to Carol. If someone calls Alice, should the call be forwarded to Carol?

If Alice is on vacation, and Bob is Alice's secretary, then the answer is probably "yes".
If Bob is on vacation, and Alice is temporarily using Bob's office, then the answer is probably "no".

Here's one using email: "Alice@host1" and "Bob@host2" correspond by email. Because Bob wishes to remain anonymous in this correspondence, he is known to Alice as anon@remailer, and the remailer retargets email for "anon@remailer" to "Bob@host2".

But now Bob turns Out-of-Office on. When mail arrives from Alice@host1, it sends a reply with "from:Bob@host2" When Alice receives the response, she learns Bob's identity. The "Remailer" and "Out-of-Office" components each work correctly, but cause a security fail when combined.

tldr: Modularity as a design principle can break down even in simple systems. This kind of thing is really important to know about if you are building software! If you want more, the papers by Pamela Zave on feature interaction are here: pamelazave.com/fi.html

PS Bob does seem to be a lazy slob who is dodging his work responsibilities (model THAT in your formal methods!). Probably that's why he wants to be anonymous.

And poor old Carol is doing two people's jobs and no one appreciates her. Thank you Carol!