Live data from Hacker News

Blue Team Rust: What Is “Memory Safety”, Really?

tiemoko.com

91–100 of 105 posts

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#91

Earlier quoted context omitted.

only if that block, or something in its "trusted set" (my term, for things in the same module that can access private members) is incorrect, though. safety/unsafety in Rust is factorable , which is a key part of the reason Rust is useful at all.

I think that is too strong. Consider this code: unsafe { libc::fork() }; let v = vec![1]; This may hang or even crash (malloc in the child) but there's no sense in which the unsafe block is "incorrect." Some unsafe code has unavoidable implications for the entire program.

Indeed, some uses of unsafe aren't meaningfully factorable. File backed memory maps or shared memory with other processes are other important real world examples that are difficult or impossible to meaningfully factor in the context of a single process. But I still think that saying "safety in Rust is factorable" is accurate beyond a mere first approximation. Figuring out how to encapsulate unsafety is, in my experience, the essential creative aspect to using unsafe at all. Because if safety wasn't something you could encapsulate, then Rust really wouldn't be what it is. (I have spent many long hours thinking about how and to what extent the safety of file backed memory maps could be encapsulated. Which is to say, factoring safety is really the ultimate goal, even if certain things remain beyond that goal.)

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#92
post #23
post #6

Earlier quoted context omitted.

The key thing with bounds checks is to hoist them out of inner loops. If you don't have that optimization, people will turn them off because of the performance impact. Except in inner loops, the performance penalty isn't usually that bad.

Disabling bounds checking seems to still be a cargo cult thing. Even when using C++ I keep them enabled (via compiler options) and it is seldom a problem in the age of Electron apps fashion. Doing something in ms instead of us is hardly an issue for 99% of applications.

Right. It's mostly a thing in number-crunching code working on matrices and in some string operations. It's important to handle small inner loops well; other than that, it's seldom a big time issue.

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#93
post #86
post #37

Earlier quoted context omitted.

Not to discredit you, but you postulate things like "9 out of 10 times" and generally "low software quality" but don't support your statements. It certainly is not my experience that this is (more, or at all) common in the Rust ecosystem. If an application author uses things like unwrap or expect (two of the most common ways to abort the program with a panic) that is indeed lazy software engineering. But these are al…

I do have a list of 10. I don't really feel comfortable posting it because I don't want to shame people, and also because it will guarantee a bunch of no-true-scottsman, "X, Y, and Z were student projects and Q was just a demo and R only panic because cargo built a debug build by default and there was an integer overflow, and M was only because I didn't provide all the required command-line arguments...". All those t…

>in a way that software written in C/C++ is usually not

This is the part that seems odd, more than your experience with Rust. How could you possibly generalize based on an unspecified sampling method across "software written in C/C++"? It's like referring to the typical quality of scientific papers written in English.

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#94
The pervasive mention of "C/C++", as if C and C++ were the same language with the same failure modes, soured the whole thing for me, for reasons:

In modern C++, C bugbears are just not a problem that demands much attention; I had one (1) memory mistake in five years, caught in initial testing.

There are still plenty of bugs, of course, but they are overwhelmingly specification bugs: code is doing what was asked for, but what was asked for was wrong.

Babysitting the borrow checker steals attention from preventing those actually very common problems. In effect, the borrow checker has also consumed all the time then spent tracking down and fixing the bugs it prevented avoiding, and all the time spent adapting to bad interfaces it caused that more or less worked.

Attention is, by far, the scarcest resource every programmer manages. Anything that burns attention without adequate return is actively harmful. Coding at a higher level, using powerful, safe libraries trusted not to cost too much, is how C++ programmers get the safety that Rust coders grind out on the borrow checker. C++ has many, many features, not in Rust, meant specifically to help capture powerful semantics in libraries that raise the level of coders' attention.

The large and still growing suite of such features, and the powerful libraries written using them, account for the almost exclusive use of C++ in all the highest-paid, most demanding applications in fintech, medtech, HPC, CAE, telecom, and aerospace. Rust will never be able to call those libraries.

Still, Rust is the only extant language plausibly gunning for C++'s role. It starts with the advantage of leaving behind many of C++'s worst backward-compatibility boat anchors, but its focus on low-level safety features detracts attention from the high-level coding support that makes them decreasingly relevant. Rust is adding features and users at a rapid rate, but C++ picks up, easily, many more new users in each week than the total headcount of Rust programmers working in that week, and will continue. To be remembered in ten years, Rust will need to become useful to many, many more programmers than it is now winning over (HN buzz notwithstanding).

Gunning for C++ is a losing strategy. Planning to coexist with C++ will have better results. Rust is an overwhelmingly better language, on every axis, than C, Go, Java, C#, ObjC, Visual Basic, Delphi, and COBOL, all being coded today mostly by people who will and often should never use C++. Every conversion from those is a big net gain for the world. Rust will pick up few C coders, despite that this would produce the greatest benefit to society, just because almost all who might jump already did. But the rest are wide open.

Promoting memory safety is not the way to win those, either because they have it (at enormous cost) or don't value it. To win those coders, Rust needs to take memory safety as given, and promote fun, performance, and a future.

Java won big in 1995 by offering Microsoft sharecroppers a way out. Rust could be the way out for a new generation, if only it can raise its sights from C's too familiar failings.

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#95
post #81

Earlier quoted context omitted.

> The software failed and did so in a user uninformative way. How is this different to any other crash in terms of user information? Whether it segfault or panics is just as uninformative. Ignoring vulnerabilities here, a SEGV catches memory bugs, but it can only catch those that result in accessing an invalid region of memory. There's plenty of memory bugs that do not result in a SEGV and instead just corrupt the pr…

> Safe rust prevents all those memory bugs, instead causing a panic. Rust is even stronger than that, in the vast majority of cases, panics are not related to memory bugs as those are caught at compile time in Rust (panics are usually the quick and dirty way to deal with invalid files names and such things, as Rust refuses to accept those silently).

> panics are usually the quick and dirty way to deal with invalid files names and such things, as Rust refuses to accept those silently

And if you were writing quick and dirty C those would likely be memory bugs instead.

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#96

Earlier quoted context omitted.

I assume OP s point is that unsoundness or UB in an unsafe block is not contained in that block, but can taint safe code anywhere in the program. Which is true.

Yes, it's true, but that wasn't what Animats said. And even if that was Animats' point, it doesn't invalidate the GP. The key value proposition of Rust isn't that "you'll never have memory safety bugs," but rather, that if your unsafe code is correct and sound, then safe Rust will be free of memory safety bugs. The important bit is the implication that grants one the power to make that sort of reasoning. It's importa…

This is indeed a very powerful property. However, I have a question: is it a regular practice to ensure that code marked unsafe is actually safe for whichever parameters it receives? Or could the safety of some unsafe code depend on the way its safe wrapper is called?

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#97

Earlier quoted context omitted.

Yes, it's true, but that wasn't what Animats said. And even if that was Animats' point, it doesn't invalidate the GP. The key value proposition of Rust isn't that "you'll never have memory safety bugs," but rather, that if your unsafe code is correct and sound, then safe Rust will be free of memory safety bugs. The important bit is the implication that grants one the power to make that sort of reasoning. It's importa…

This is indeed a very powerful property. However, I have a question: is it a regular practice to ensure that code marked unsafe is actually safe for whichever parameters it receives? Or could the safety of some unsafe code depend on the way its safe wrapper is called?

If you have an unsafe function---that is, a function that is unsafe to call---then it is common practice to document the precise preconditions that the caller must uphold in order to ensure safety. This may indeed include passing a correct parameter. For example, the preconditions of the slice method `get_unchecked` require the caller to verify that the index provided is in bounds, otherwise the behavior is UB.

If you have a safe function that uses unsafe internally, then all possible invocations of that function should be safe. If this isn't true, then we call those sorts of APIs unsound and they are strongly discouraged. David Tolnay wrote a great blog post about it: https://docs.rs/dtolnay/0.0.7/dtolnay/macro._03__soundness_b...

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#98

Earlier quoted context omitted.

How do you write the assert? I've not heard of that before. Oh you mean `assert!(array.len() > 100); for i in 0..100 { array[I]; }` I don't think that guarantees that bounds checks will be hoisted. It's just a strong hint. I mean in this case it will almost certainly work, but in more complexes cases it might not and the compiler is still free to emit bounds checks without telling you. It would be nice if there was a…

In Rust, the way to force removal of bounds checks is to use iterators rather than a for loop.

I don't think that forces their removal either. It just happens to help the compiler enough that it can remove them automatically most of the time.

As far as I know the only way to guarantee that bounds checks are not used in a block of code is to use `unsafe`.

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#99

Earlier quoted context omitted.

There's also just not that much Rust software out there, and 80% of everything is crap. If you compare the best, say, C tool to do something against the best Rust tool, the odds that the Rust tool will be lower-quality are higher - the Rust tool is probably the only Rust tool written to do that, while the C tool is probably the best C tool that's survived over the years.

As someone who has worked with a lot of Rust libraries and applications, your estimate on quality is completely made up hyperbole with the clear intention of maligning Rust. I have experienced far more success in using Rust and its library ecosystem than I ever have in other languages. Yes there are bugs in somethings, yes there are others that don’t follow best practices, but throwing out a number of “80%” completel…

Woah, woah, hold on. I'm just referencing https://en.m.wikipedia.org/wiki/Sturgeon%27s_law here.

As somebody who has written a lot of cruddy, unmaintained Rust library bindings because I needed them for a project, I'm speaking, in no small part, about my own work here. Sorry if that wasn't clear.

90% of everything is crap- C or Rust- because there are a whole lot more low-effort libraries and tools than high-quality, maintained, documented ones. There's less Rust code, so the low-effort tools are more visible.

Rust is my favorite programming language, and I use it for everything where a REPL isn't critical (there Python still wins) unless other factors prevent the use of Rust, like the need to work with others or run on weird embedded architectures. I've been writing Rust since before 1.0, was at the 1.0 launch party in SF, and even contributed the (hilariously small, but) std::iter::once API.

So- my intention was "clearly" to malign Rust? Well, actually, it was to defend it. Again, sorry if that wasn't clear, but ...assume good faith next time! Please!

Re: Blue Team Rust: What Is “Memory Safety”, Really?

#100

Earlier quoted context omitted.

As someone who has worked with a lot of Rust libraries and applications, your estimate on quality is completely made up hyperbole with the clear intention of maligning Rust. I have experienced far more success in using Rust and its library ecosystem than I ever have in other languages. Yes there are bugs in somethings, yes there are others that don’t follow best practices, but throwing out a number of “80%” completel…

Woah, woah, hold on. I'm just referencing https://en.m.wikipedia.org/wiki/Sturgeon%27s_law here. As somebody who has written a lot of cruddy, unmaintained Rust library bindings because I needed them for a project, I'm speaking, in no small part, about my own work here. Sorry if that wasn't clear. 90% of everything is crap- C or Rust- because there are a whole lot more low-effort libraries and tools than high-quality,…

We can agree that there is a lot of low effort stuff out there. But there’s also a ton a high quality rock solid software written in Rust.

Your comment sounded dismissive of Rust, and even reading it again, I still don’t see it as defending Rust. Glad you set the record straight.

Thank you.

Post reply on HN