"Spreadsheets for developers" by Felienne Hermans
Analysts investigate attack surfaces and defenses concerning "Spreadsheets for developers" by Felienne Hermans.
Summary
### Overview In this talk, Felienne Hermans, an assistant professor at Delft University of Technology, argues that spreadsheets should be understood and treated as actual source code rather than mere data. She demonstrates that spreadsheets are Turing complete, solve typical software calculation problems, and suffer from common software maintenance issues such as a lack of documentation and long lifespans with multiple maintainers. Hermans pitches spreadsheets as a live, pure functional programming language and advocates for bringing established software engineering practices into spreadsheet environments.
### Key Topics - **Spreadsheets as Programming Languages:** Hermans provides three core arguments for treating spreadsheets as code: they are used to solve software problems (often chosen because traditional software projects take too long and cost too much), they are Turing complete (demonstrated by implementing a Turing machine entirely within spreadsheet formulas), and they suffer from classic software problems. - **Advantages of the Spreadsheet Paradigm:** Spreadsheets offer live programming without explicit compilation steps, enforce pure functional semantics where formulas only produce outputs from cell inputs without side effects, and act as a ubiquitous computing interface used across many disciplines. - **Implementing Algorithms in Excel:** Hermans walks through implementing the selection sort algorithm in Excel using native functions (`MIN`, `MATCH`, `INDEX`, `OFFSET`) and conditional formatting as a visual debugger. She then refactors the implementation into readable, novel-like code using space-based intersection syntax, constants, and dynamic named ranges powered by `ROW` and `INDIRECT`. - **Software Engineering Tools for Spreadsheets:** Based on her PhD dissertation and work at the Spreadsheet Lab, Hermans introduces two Excel plugins designed to assist end-user developers: Bumblebee (a formula refactoring tool) and Expector (a test suite generation and test coverage visualization tool).
### Technical Details - **Turing Completeness and Sorting:** Hermans showcases a Turing machine where each row represents an iteration of the tape. For selection sort, she tracks minimum values and swaps using `MATCH` and `OFFSET`. She eliminates hardcoded cell coordinates by using dynamic named ranges that evaluate Excel formulas containing `INDIRECT` to reference preceding rows. - **Bumblebee:** An Excel 2010 plugin that parses spreadsheet formulas and suggests automated rewrites, such as replacing `SUM(...) / COUNT(...)` with `AVERAGE(...)`. It also features a domain-specific rewrite language enabling power users to specify custom refactoring patterns across ranges, worksheets, or whole workbooks. - **Expector:** An Excel plugin that inspects spreadsheets for informal ad-hoc assertions (e.g., `IF(SUM(...) <> 100, "error", "ok")`), parses passing and failing heuristic outputs (such as text keywords or smiley faces), converts them into formalized regression test suites, and calculates visual test coverage across dependent cells.
### Takeaways Hermans concludes that spreadsheet creators are programmers who lack the tooling standard in modern software engineering (such as IDEs, linters, refactoring tools, and test suites). Applying software engineering principles and specialized tooling to spreadsheets improves code maintainability, correctness, and auditability in critical settings like finance.
Related talks
Strange Loop Conference·29 min
Security researchers examine technical aspects of Strange Loop Chat with Felienne Hermans about "The Programmer's Brain".
Strange Loop Conference·52 min
Industry experts analyze emerging threats surrounding "How to teach programming (and other things)?" by Felienne Hermans.
Strange Loop Conference·9 min
Felienne Hermans
Presenters detail vulnerability discovery and exploitation in Felienne Hermans: How patterns in variable names can make code easier to read.


