Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rust is mostly safety

graydon2.dreamwidth.org

Post reply on HN
Print view View original

261–270 of 474 posts

Re: Rust is mostly safety

#261

Post by smitherfield »

1wd wrote: post #102
moxious wrote: post #66

Earlier quoted context omitted.

It's not "countless" it's "uncountable" because we couldn't agree on what a software caused death was. In my CS program we had an ethics class that included stories of bad X-ray machine software that overdosed people. Bad, bad bad. I don't think many people died as a direct result, but 10 years later there was probably a spiked cancer incidence. Did software kill people? Well yeah....kinda. In airplane systems, there…

Errors in the software of the radiation therapy machine Therac-25 directly lead to the death or serious injury of six patients. Three patients died within weeks or months. http://radonc.wdfiles.com/local--files/radiation-accident-th... Errors in the software of a MIM-104 Patriot resulted in failure to locate and intercept an incoming missile and the death of 28 soldiers. http://www.gao.gov/products/IMTEC-92-26 Errors…

> Errors in the software of the radiation therapy machine Therac-25…

Caused by unsigned 8-bit integer overflow combined with (presumably) treating 0 as falsy. May or may not have been solved by using Rust (but probably wouldn't have because it sounds like a logic error in "clever" code).

> Errors in the software of a MIM-104 Patriot…

Caused by loss of precision in floating-point calculations. Would not have been solved by using Rust.

The other two were more likely human or mechanical than (unspecified) software errors.

Re: Rust is mostly safety

#262

Post by llogiq »

paulddraper wrote: post #252

If you're a C++ programmer, Rust is mostly about memory safety. If you're a Java programmer, Rust is mostly about tighter resource usage. If you're a Python programmer, Rust is mostly about type safety and speed.

I'm a polyglot programmer and for me Rust is mostly about the awesome abstractions and the great community.

Re: Rust is mostly safety

#263

Post by kibwen »

agentgt wrote: post #94

I'm a lowly ancient Java programmer and I think Rust is far far more than safety. In my opinion Rust is about doing things right. It may have been about safety at first but I think it is more than that given the work of the community. Yes I know there is the right tool for the right job and is impossible to fill all use cases but IMO Rust is striving for iPhone like usage. I have never seen a more disciplined and bal…

I think this comment and the OP are both correct. The point of Rust is safety, in the sense that memory safety should be the default for all programming languages, and has been the default for all non-systems languages since the 90s. The only holdouts have been because people used to claim that memory safety wasn't possible without making a language unusably slow, which Rust has disproven. In all my years of teaching Rust, I can't count how many times I've told people that you can have a memory-safe systems language without garbage collection and have them look me in the eye and say, "what, no, that's supposed to be impossible", and I still get a kick out of it every time.

The importance of Rust is that it's raised the baseline for low-level languages in the modern age. If any future systems languages emerge that don't feature memory safety, it will have to be a deliberate choice that must be defended rather than just an implicit assumption of how the world works.

Re: Rust is mostly safety

#264

Post by zpallin »

I agree with the premise of the article.

However, I feel that Steve Klabnik is trying to dispel myths about Rust not being anything "but" safety, to shape how other Rust developers talk about Rust, not denying that Rust's central purpose is around being a safe language.

This is because there is a lot of miscommunication about Rust. A lot of people who aren't immediately sold on the language walk away thinking it's slow (it's not), it's complicated (not really), and not production ready (it actually is). And that's because Rust developers don't know how to talk about Rust. I am guilty, for one.

Since Steve is such a huge part of RustLang development, it's his duty to direct the conscious effort to promote the language.

No reason to get into a debate over click-baity titles. :)

Re: Rust is mostly safety

#265

Post by sidlls »

psyc wrote: post #154
jMyles wrote: post #5

> countless lives lost I have no doubt that people have had their lives ruined, or even died, as the result of flaws in system programming, but is anyone actually tracking this? Is it "countless?"

TDD: "If you're not doing this, you're not a real engineer." Rust: "If you're not doing this, you're a murderer."

Yep. That may not be the intention but it certainly comes off that way.

Re: Rust is mostly safety

#266

Post by steveklabnik »

smitherfield wrote: post #261
1wd wrote: post #102

Earlier quoted context omitted.

Errors in the software of the radiation therapy machine Therac-25 directly lead to the death or serious injury of six patients. Three patients died within weeks or months. http://radonc.wdfiles.com/local--files/radiation-accident-th... Errors in the software of a MIM-104 Patriot resulted in failure to locate and intercept an incoming missile and the death of 28 soldiers. http://www.gao.gov/products/IMTEC-92-26 Errors…

> Errors in the software of the radiation therapy machine Therac-25… Caused by unsigned 8-bit integer overflow combined with (presumably) treating 0 as falsy. May or may not have been solved by using Rust (but probably wouldn't have because it sounds like a logic error in "clever" code). > Errors in the software of a MIM-104 Patriot… Caused by loss of precision in floating-point calculations. Would not have been solv…

Integer overflow is defined to panic in debug builds, and either do that or two's compliment overflow in release builds. The current implementation overflows. However, zero is not false.

Re: Rust is mostly safety

#267

Post by llogiq »

Ar-Curunir wrote: post #105
moxious wrote: post #63

Earlier quoted context omitted.

> Any time your code takes in untrusted input, it should not be written in an unsafe language. So basically just about all programs, all of the time? https://www.owasp.org/index.php/Don't_trust_user_input

I agree, but people seem to feel that their code should somehow be exempt from such advice, and so sacrifice safety for performance. This leads to today's sorry state of affairs.

The problem is that safety doesn't sell. If you're getting a new IoT heat lamp you look at the price and not the firmware's code. To your surprise, the first hacker coming along toasts your cat.

Re: Rust is mostly safety

#268

Post by smitherfield »

steveklabnik wrote: post #266
smitherfield wrote: post #261

Earlier quoted context omitted.

> Errors in the software of the radiation therapy machine Therac-25… Caused by unsigned 8-bit integer overflow combined with (presumably) treating 0 as falsy. May or may not have been solved by using Rust (but probably wouldn't have because it sounds like a logic error in "clever" code). > Errors in the software of a MIM-104 Patriot… Caused by loss of precision in floating-point calculations. Would not have been solv…

Integer overflow is defined to panic in debug builds, and either do that or two's compliment overflow in release builds. The current implementation overflows. However, zero is not false.

I assume that treating 0 as false was intentional in this case (it probably was written in PDP-11 ASM) and a direct translation of the Therac code therefore would be

  if counter > 0 {
      deploy_radiation_shield();
  }

Re: Rust is mostly safety

#269

Post by echelon »

geodel wrote: post #226
ocschwar wrote: post #191

Rust is about letting the compiler slap you for your mistakes in the privacy of your own Xterm, instead of letting Jenkins do it 10 minutes later, in front of all your co-workers.

Maybe it will change in future. Currently slaps seems so hard that developers are still smarting and not producing code for production

It takes time to get used to writing Rust, dealing with the borrow checker, and fulfilling the proper trait bounds (Sync, Send, Sized, etc). I don't run into nearly as many compiler complaints now that I've written my fair share of Rust code. I feel like I'm quite productive in Rust, actually.

Re: Rust is mostly safety

#270

Post by EugeneOZ »

rubber_duck wrote: post #241
svckr wrote: post #110

Earlier quoted context omitted.

I absolutely agree. If you look at Rust from a systems programmer perspective and compare it with the systems languages OP lists then, yes, safety is THE most radical feature. But Rust can compete on so many more levels. Web services, user facing applications for example. Languages competing in that space usually bring memory safety, so it's kind of a non-issue. Safety enables Rust to be a viable choice for these tas…

>But Rust can compete on so many more levels How ? There are languages with more expressive type systems high level type systems (Haskel/OCaml presumably). There are languages with much more mature libraries, ecosystems and tooling (C#/Java). There are languages with both (F#/Scala). What is it that makes Rust a good applications programming language ? You said it your self GC doesn't really matter that much in this…

When I write in Rust, I have feeling "that's how programming should work". I don't know how to express it in more scientific way. Errors handling, pattern matching, Result type - it's all how it should work. I know, some other languages have similar features, but Rust also has race-conditions protection (very important thing), good package manager out of the box, testing tool (cargo test), very smart compiler and great performance - just all the best.
Post reply on HN