What it feels like when Rust saves your bacon • Hacker News Board

Re: What it feels like when Rust saves your bacon

#171

Post by grogers » Sat, Jun 25, 2022, 12:52 PM UTC

shuger wrote: post #8

This article is super overcomplicated. All it had to say was that rust tells you when you keep reference to on stack variable after it goes out of scope. Context provided adds nothing. I must say - as someone who doesn't use rust - I haven't had this type of issue in years, and when I did it wasn't hard to debug. You get corrupted data, set data breakpoint and in the provided example you will see it being modified by…

This case might be trivial to debug, but when you start adding concurrency a lot of that ease goes out the window. Right now, our tests are mildly flaky because of asan crashes from use after stack frame issues. Reading the code it should be joining all the coroutines on destruction, but yet the asan violations are happening. It really isn't that trivial to debug. Luckily in our case it doesn't affect production since it's only on shutdown (probably...?).

Re: What it feels like when Rust saves your bacon

#172

Post by jandrewrogers » Sat, Jun 25, 2022, 1:24 PM UTC

strictfp wrote: post #169

jandrewrogers wrote: post #168

Earlier quoted context omitted.

Okay, yeah, I would broadly agree with this. I think most people use template-based polymorphism, which is pretty flexible in practice. The use of virtual methods is verboten for many common use cases of C++, due to the necessity of being in paged memory, so constructions for dealing with polymorphism without virtual methods are commonplace. And std::variant is a bit of a hot mess.

> The use of virtual methods is verboten for many common use cases of C++, due to the necessity of being in paged memory I wasn't aware of this. Maybe I'm just out of the loop. Do you know where one can I learn more about this? I'm desperately trying to reduce the number of virtual calls in our codebase, but I'm hitting the aforementioned problems.

It is a design problem endemic to database engines and probably file systems. A design requirement for most of the dynamic runtime data structures is that they can be directly paged to storage, either in whole or in part, and be paged from storage in an arbitrarily distant future on different machines with different compilers. In order to make this work, all data types used in pageable data structures must 1) have a size and alignment that is not compiler-dependent so that page types always have a size that is a strict multiple of the I/O page size and 2) not contain any pointers. This precludes vtables.

This has traditionally been managed with CRTP, tagged unions, etc with some scaffolding to make it convenient and compliant with strict aliasing rules. Ideally, almost all of the dynamic polymorphism is pulled up to the level of the page types, an opaque blob of I/O friendly complex data structure, minimizing the amount you have to do. It is also important to note that JIT-ing has replaced many of the use cases for dynamic dispatch e.g. adding user-defined schemas at runtime.

None of which may apply to your use case. Some things inherently require an unfortunate amount of dynamic dispatch.

Re: What it feels like when Rust saves your bacon

#173

Post by heisjustsosmart » Sat, Jun 25, 2022, 1:47 PM UTC

jandrewrogers wrote: post #172

strictfp wrote: post #169

Earlier quoted context omitted.

> The use of virtual methods is verboten for many common use cases of C++, due to the necessity of being in paged memory I wasn't aware of this. Maybe I'm just out of the loop. Do you know where one can I learn more about this? I'm desperately trying to reduce the number of virtual calls in our codebase, but I'm hitting the aforementioned problems.

It is a design problem endemic to database engines and probably file systems. A design requirement for most of the dynamic runtime data structures is that they can be directly paged to storage, either in whole or in part, and be paged from storage in an arbitrarily distant future on different machines with different compilers. In order to make this work, all data types used in pageable data structures must 1) have a…

Virtual methods are about dispatch tables (which are built at compile time) and have nothing to do with paging. Nothing. At all.

Re: What it feels like when Rust saves your bacon

#174

Post by dralley » Sat, Jun 25, 2022, 1:59 PM UTC

blub wrote: post #145

kevincox wrote: post #141

Earlier quoted context omitted.

> less time debugging I would say it isn't even the debugging. As many of the C++ programmers here have said as you get good at C++ this becomes something that you are vigilant for and it rarely actually gets written. But just the lack of even needing to think about it is a huge load off my mind. When I used to write C++ I never really realized how vigilant I was. Every time I added code into the middle of a function…

And what are you thinking about now? For me it was what lifetimes and types to use to make my program work. Just as it was in C++, but with a static verification step at the end which most of the time got in my way. Rust makes lots of sense in high-churn projects or projects which have very high security requirements (like browsers). Otherwise I’d think carefully about using it.

You had to think about lifetimes in C++, too, but in Rust at least they're written down and enforced.

Re: What it feels like when Rust saves your bacon

#175

Post by antifa » Sat, Jun 25, 2022, 2:14 PM UTC

kelnos wrote: post #128

kjksf wrote: post #18

Earlier quoted context omitted.

The thing they rewrote also worked great in production. And fuzzing originated in C / C++ tools and is available for them as well, probably more diverse and mature than what is available in Rust. The point you did ignore was: Rust is being sold as magically making software safe and people selling that completely ignore the fact that logical bugs are also a thing. Which Rust evangelists find difficult to acknowledge b…

> Rust is being sold as magically making software safe and people selling that completely ignore the fact that logical bugs are also a thing. I don't think that's true. Sure, there are zealots who oversell things, but reasonable people (including those who are actual leaders in the Rust community) are realistic about the classes of bugs that Rust eliminates, as well as those Rust doesn't help with.

Rust is interesting in that if you really thought it was magical safety across all bugs, you're probably not smart enough to compile a real application, let alone actually have read enough documentation to do more than a hello world.

Re: What it feels like when Rust saves your bacon

#176

Post by ttfkam » Sat, Jun 25, 2022, 2:25 PM UTC

3a2d29 wrote: post #119

jackmott42 wrote: post #91

Earlier quoted context omitted.

I see many C++ programmers say stuff like this, and maybe it is the case that studios exist which can do C++ without mistakes related to memory management or sigils and so on, but I also observe that: 1. High quality teams like the Linux kernel team and PostgreSQL, do periodically have serious security bugs that are things Rust would have caught. 2. I see sometimes C++ instructors making the same claims you do and th…

> High quality teams like the Linux kernel team and PostgreSQL, do periodically have serious security bugs that are things Rust would have caught. Safe rust would have caught. If you had to drop into unsafe to do what they did, the serious security bugs would still have happened.

Except when something goes wrong, you can typically focus all your attention on the unsafe blocks, which should be a very small portion of your codebase, if it exists at all. (Contrary to popular belief, unsafe Rust code is neither mandatory nor widespread.)

By contrast and comparing apples to apples, your entire C or C++ codebase is the equivalent of one giant unsafe block. You can bring in 3rd party tools to perform some of the static analysis the Rust compiler does for you, but call it for what it is.

By default, Rust is safe while C & C++ are not.

Re: What it feels like when Rust saves your bacon

#177

Post by ttfkam » Sat, Jun 25, 2022, 2:42 PM UTC

duckerude wrote: post #136

smolder wrote: post #114

Earlier quoted context omitted.

If you're willing to jump back to C++ to get around the borrow checker strictness, couldn't you just use Rust's unsafe block where you're sure it won't result in a bug? Is it harder to fuzz Rust? Honest question, because fuzzing is something I occasionally read about but am not practiced in.

I've found it very easy to get started with fuzzing in Rust using cargo-fuzz. I didn't do anything very advanced, and my closest point of reference is testing Python with Hypothesis, but it did turn up bugs. Here's a Rust fuzzing story from yesterday: https://hacks.mozilla.org/2022/06/fuzzing-rust-minidump-for-... It claims that Rust is particularly suitable for it because integer overflow panics in debug builds (and…

> And what did we screw up? Some legit stuff! It’s Rust code, so I am fairly confident none of the issues were security concerns, but they were definitely quality of implementation issues, and could have been used to at very least denial-of-service the minidump processor.

This is so much better than the outcome would have been in any C or C++ project despite the many protestations of "just follow modern best practices" adherents. The author of minidump is no novice, is well versed in best practices in multiple languages including C++, was sure the code was solid, and still got spanked hard by the fuzzer. Denial of service outcomes aren't ideal, but they were likely fewer in number and are unambiguously better than security vulnerabilities.

Re: What it feels like when Rust saves your bacon

#178

Post by ttfkam » Sat, Jun 25, 2022, 2:52 PM UTC

jackmott42 wrote: post #100

jesse__ wrote: post #95

Earlier quoted context omitted.

I'd venture that the development slowdown from using rust is closer to 50% than 5%. Even just compile times probably slow down that much, not to mention you have to write (sometimes) as much as 10x code to express yourself. The specific exercise I have in mind is a lockless thread queue. < 20 lines in C .. ~200 lines in Rust.

I'm sure there is a ton of variance. I have done some Rust projects where I run into absolutely no safety complaints from Rust because it just isn't the kind of code that does anything the borrow checker cares about. For those development time ends up typically faster than C/C++ due to various syntax and tooling niceties. Other projects will really get into domains where you have to work hard to satisfy the borrow ch…

And you're running at least one static analysis tool and a linter on your C++ code too, right? You're not just deploying the C++ compiler output as-is, right?

Those take time to run too and should absolutely be added to the compile time metrics when comparing against "cargo build".

Re: What it feels like when Rust saves your bacon

#179

Post by jesse__ » Sat, Jun 25, 2022, 3:00 PM UTC

__jem wrote: post #150

jesse__ wrote: post #95

Earlier quoted context omitted.

I'd venture that the development slowdown from using rust is closer to 50% than 5%. Even just compile times probably slow down that much, not to mention you have to write (sometimes) as much as 10x code to express yourself. The specific exercise I have in mind is a lockless thread queue. < 20 lines in C .. ~200 lines in Rust.

> The specific exercise I have in mind is a lockless thread queue. Why is this your exercise you have in mind though? This is such a bad argument. Like, yes, if you work at doublylinkedlist.com where your entire job is writing a new linked list implementation every day of the week, Rust might be a bad choice. But that's not what any kind of commercial enterprise actually looks like. If I saw you writing a lockless th…

>> Why is this your exercise you have in mind though?

That was an example I could point to where the code size difference between Rust and C or C++ is roughly 10x. I mentioned it to corroborate the claim that sometimes writing Rust is very verbose, on the order of ten times more.

My point was not that average commercial codebases are largely dominated my these types of structures. My point was that my experience with Rust has been that the development slowdown is much more than 5%, as the OP suggested.

>> If I saw you writing a lockless thread queue at work, I'd tell you to stop wasting time.

And that's one reason we don't work together ;)

Re: What it feels like when Rust saves your bacon

#180

Post by ttfkam » Sat, Jun 25, 2022, 3:03 PM UTC

phendrenad2 wrote: post #160

bestouff wrote: post #22

Earlier quoted context omitted.

Yeah no. In my experience, when several people commit to a common C/C++ codebase this kind of issue become really exhausting when it happens more than once, and the symptoms may be so subtle it's a bitch to debug. Rust lowers your mental load. You spend more time being creative and way less time debugging "obvious" (or not) mechanical problems (reference not-on-stack-anymore variables, use-after-free, concurrent writ…

Nope. In my experience, Rust saves you from very common obvious errors that junior programmers make, certainly not 10x programmers who have been writing C for a long time. It's great when you're starting out (which is why it's massively popular with new graduates or people who are just learning to program), but at some point it's questionable if the hand-holding Rust gives you is worth the extra development time over…

Yep, all those kernel, driver, and database devs out there are all junior devs just starting out. No way anyone with decades of experience will introduce a remote exploit or crashing bug in their C programs and libraries. Never happens. No CVEs to see here! Move along!

/s