Earlier quoted context omitted.
What makes you think software developers write the same average amount of lines of code per day ? It seems to me the higher level the language is, higher is the average number of loc per day. IHMO Debugging has an huge impact on this average and lower level languages are harder to debug.
I have not found Rust any harder to debug than, say, Python. LLDB works fine.
Rust for the Web
61–70 of 100 posts
Re: Rust for the Web
#62Man Rust is super hard already! I mean people told me it would be harder to think functionally but after clojure, i think lisps are super easy. But i feel Rust is way harder than anything. Infact i feel Haskell is comparatively easier than Rust. So i am not sure why one wants to use it for web. I think Rust has a place and that is to replace C++ for system software, possibly even C for writing Kernels because why not…
I disagree. I think Rust is pretty easy once you've spent a bit of time learning about lifetimes. It should be substantially less surprising when it's got non-lexical lifetimes, though. Rust seems to me eminently suited to write high-performance web applications.
There is a lot to like about Rust, but here are some things that I think make rust hard (and I think the difficulty of these features outweigh any productivity granted by the safety features).
First, the affine type system--I don't understand the use case for pushing ownership deeper into the stack by default, and it seems crazy that I have to know how all instances of a given type will be passed at definition time. It doesn't seem to facilitate safety, or at least it seems like the most flat-footed approach to preventing double-frees (never let two functions access the same memory, even those that can be trivially proven to run sequentially). I literally never want to move--I always want to shallow copy (or reference). Further, you can't call most pass-by-value functions from inside a pass by reference function because the former usually wants to destroy the value. Copy works around this in the simplest cases, but for the most part you end up with two categories of classes that can't be mixed. This is especially bad for open traits, where the trait definition has to decide how all implementations will pass and receive their arguments.
Beyond that, when defining a struct type that holds a reference, you have to know at definition time the lifetime of that reference, even it may vary from instance to instance (sometimes I want the struct to own the reference, but sometimes I don't). Maybe there's a way to express this in Rust, but it seems like the default is to assume that lifetimes are part of the type. This creates another dichotomy in types: those that own their data and references to data (String vs STR, vec vs slice, etc).
I like Rust. I love that it's an ML with a sane syntax, or a C-family language with decent functional features and sum types. I just can't justify these impediments. :(
Re: Rust for the Web
#63Earlier quoted context omitted.
I have not found Rust any harder to debug than, say, Python. LLDB works fine.
I have no experience with rust so I can not elaborate on that, but I find harder to debug a multi-threaded C++ application where race condition and memory corruption is possible than a python one. That difficulty has an impact on average daily productivity on LOC.
As I recall, there is another bit of research that claims that the number of bugs written in all languages is about the same, except C++ which produces way more.
Re: Rust for the Web
#64Earlier quoted context omitted.
Haskell has more concepts than Rust (like higher kinder types) and should get linear types soon. Rust seems like Go with some Java and the great borrow checking system.
With the best will in the world, linear types are still going to take some serious work. Look at the guy doing a linear type streaming library. And that's just at the language level. You then need pervasive library support. And then you need more GHC work on optimisation, work out how you interoperate with levity polymorphism and so on and so on. And _after_ all this work is done, I seriously doubt you'll be able to…
Which might be totally irrelevant in most use cases, if it is within the desired application bounds.
I have replaced more C++ systems with Java and .NET solutions than the other way around.
Re: Rust for the Web
#65Earlier quoted context omitted.
Slashes aren't allowed, so wouldn't be able to do any path traversals: https://api.rocket.rs/src/rocket/request/param.rs.html#298
> On Windows, decoded segment contains any of: '\' And on Japanese and Korean windows? It uses the yen symbol as path separator. Depending on how the path is read or interpreted, filtering the yen may be necessary. https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).a...
Re: Rust for the Web
#66Earlier quoted context omitted.
With the best will in the world, linear types are still going to take some serious work. Look at the guy doing a linear type streaming library. And that's just at the language level. You then need pervasive library support. And then you need more GHC work on optimisation, work out how you interoperate with levity polymorphism and so on and so on. And _after_ all this work is done, I seriously doubt you'll be able to…
> And _after_ all this work is done, I seriously doubt you'll be able to control memory usage as well as Rust does now. Which might be totally irrelevant in most use cases, if it is within the desired application bounds. I have replaced more C++ systems with Java and .NET solutions than the other way around.
Re: Rust for the Web
#67Re: Rust for the Web
#68Earlier quoted context omitted.
I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.
Based on a quick read of the source, the conversion from a " " input to a "PathBuf" type strips leading ".." components automatically.
ValidDir/../../../../../../../etc/passwdRe: Rust for the Web
#69Nice overview, it might be worth mentioning that Emscripten isn't a tier 1 platform[1]. We've seen some asserts thrown in LLVM when building debug but go away when build release. I've been trying to isolate it down to a reproducible sample but haven't nailed down exactly what's causing it yet. Even with that issue it's been great to work with. I find myself so much more productive with Rust compared to C/C++. [1] htt…
If you've got something large that asserts consistently, you could consider throwing some CPU time at it via creduce. It is designed for C, but Rust is close enough that a lot of its heuristics still work just fine. Alternatively, since setting up/running creduce can be bit fiddly, if the code is open source, I suspect that someone would do it for you if you filed a bug against Rust pointing to an exact commit that d…
Re: Rust for the Web
#70Earlier quoted context omitted.
I disagree. I think Rust is pretty easy once you've spent a bit of time learning about lifetimes. It should be substantially less surprising when it's got non-lexical lifetimes, though. Rust seems to me eminently suited to write high-performance web applications.
Let's be serious, Rust will never be as easy to use as a language with GC. It will perform better on many metrics, but you have to pay that cost.