Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safety: A comparaison between Rust, C++ and Go

nested.substack.com

Post reply on HN
Print view View original

181–188 of 188 posts

Re: Safety: A comparaison between Rust, C++ and Go

#181

Post by benreesman »

benreesman wrote: post #37
BoardsOfCanada wrote: post #31

Earlier quoted context omitted.

I think memory safety is the killer feature of rust, and has become so because people see the real world problem it's solving, more than through evangelicalism. We'll see in a few years when more "heavy shit" has been written/rewritten in rust. My prediction is that they will have significantly fewer memory safety issues than comparable c++ "heavy shit".

From where I sit the killer feature of Rust is that a bunch of amazingly cool software is written in it, especially in the terminal. I'm a big terminal guy, and I can't think off the top of my head of anything I use constantly that isn't written in Rust. `rg`, `fzf`, `zoxide`, `bat`, `viddy`, the list goes on and on, I fucking love the shit people are writing in Rust. And I think that should be the killer feature of…

I'm embarrassed enough about misattributing like 2/5 to Rust that are written in golang, so I just dumped my minimum (non-work) `home.nix` package list: https://gist.github.com/johnnystackone/bacd9275296f3d5d0cd75....

I'm not going to go through every one and remember/look up which ones are written in Rust, but I'll wager that half-ish of them are.

Re: Safety: A comparaison between Rust, C++ and Go

#182

Post by jjnoakes »

benreesman wrote: post #180
jjnoakes wrote: post #170

Earlier quoted context omitted.

I deal with issues like this about once a month. It may not happen where you work, but it definitely still happens. If it really never happens where you work, consider yourself lucky.

Is every diff thoroughly reviewed? Is everything built with `-Wall -Wpedantic -Werror`, `clang-tidy` with most checks on, ASAN/TSAN/MSAN/UBSAN on every commit in the CI, and aggressively canaried against replay data (or whatever is appropriate to the domain to exercise all the paths)? Is all the code run through `clang-format` in a pre-commit hook to lower the cognitive overhead of spotting bugs? I completely underst…

We still develop on and support platforms where we use the vendor compilers (which don't have many of those modern features).

Re: Safety: A comparaison between Rust, C++ and Go

#183

Post by jjnoakes »

benreesman wrote: post #176
Rusky wrote: post #171

Earlier quoted context omitted.

A sibling comment suggests this has more to do with where you work than how modern your C++ is, which rings true to me. Different kinds of programs need different kinds of memory management patterns, and some are more error-prone than others. In my experience there also tends to be a long tail of memory corruption bugs. After flushing out those that are easy to run into or that have a major impact, everything seems f…

If you need extreme robustness you have to have coverage and fuzzing and canaries and stuff for logic bugs as well as memory bugs. If you’ve got a long tail of non-exercised code paths, a “ ” will fuck up your day just as bad as a use-after-free. If your code is covered, ASAN will red-zone the memory bug. It checks every address. People are welcome to their subjective opinions about the “easiest” way to get truly cor…

> a “” will fuck up your day just as bad as a use-after-free

One is categorically worse than the other though.

Re: Safety: A comparaison between Rust, C++ and Go

#184

Post by phendrenad2 »

pdimitar wrote: post #121
phendrenad2 wrote: post #94

Can we throw Python in too? Python has more safety than any of these languages, yet it's always left out of these discussions.

You're joking, right? A dynamically-typed language has more safety?...

What is Python lacking that would make it as safe as Rust?

Re: Safety: A comparaison between Rust, C++ and Go

#185

Post by touisteur »

benreesman wrote: post #164
touisteur wrote: post #56

Earlier quoted context omitted.

I wouldn't say python takes C++ interop seriously, it's more like the pybind11 people are amazing at what they do and found a way to slice the problem neatly. But yes, it's night and day, pybind11 is a godsend.

Haha I don't know if it matters much whether we praise the `pybind11` folks in particular or the Python community in general or both: they are fucking amazing at what they do. It's such a hard problem that most language communities don't even seriously try, it's a nightmare to get even close on, and they get more than close. Everything just works exactly as you'd expect, with great performance (relatively speaking of…

Oh I meant C++ binding was more of a pain before. I've been doing swig and other kinds of C FFI wrapping for years and this is far better...

Of course it relies on the module/extension API from python that is quite amenable to this kind of full-object and their methods binding. But it works very well together.

So much that we asked similar for Ada https://github.com/AdaCore/Ada-py-bind (Raphael Amiard from AdaCore is quite the Ada hacker) which, even with the limitations of Ada generics, has been a godsend for scripting Ada objects from python.

Re: Safety: A comparaison between Rust, C++ and Go

#186

Post by benreesman »

touisteur wrote: post #185
benreesman wrote: post #164

Earlier quoted context omitted.

Haha I don't know if it matters much whether we praise the `pybind11` folks in particular or the Python community in general or both: they are fucking amazing at what they do. It's such a hard problem that most language communities don't even seriously try, it's a nightmare to get even close on, and they get more than close. Everything just works exactly as you'd expect, with great performance (relatively speaking of…

Oh I meant C++ binding was more of a pain before. I've been doing swig and other kinds of C FFI wrapping for years and this is far better... Of course it relies on the module/extension API from python that is quite amenable to this kind of full-object and their methods binding. But it works very well together. So much that we asked similar for Ada https://github.com/AdaCore/Ada-py-bind (Raphael Amiard from AdaCore is…

I have to admit to basically total ignorance of Ada. It's got a heritage around avionics-type stuff right, extreme low defect tolerance settings? Looks kinda like Pascal?

Is it something that a true polyglot hacker needs to know? It's got important, novel ideas or unique applications that aren't addressed well by other tools? I love learning languages, but there are so many you'll never learn them all well.

Re: Safety: A comparaison between Rust, C++ and Go

#187

Post by benreesman »

jjnoakes wrote: post #182
benreesman wrote: post #180

Earlier quoted context omitted.

Is every diff thoroughly reviewed? Is everything built with `-Wall -Wpedantic -Werror`, `clang-tidy` with most checks on, ASAN/TSAN/MSAN/UBSAN on every commit in the CI, and aggressively canaried against replay data (or whatever is appropriate to the domain to exercise all the paths)? Is all the code run through `clang-format` in a pre-commit hook to lower the cognitive overhead of spotting bugs? I completely underst…

We still develop on and support platforms where we use the vendor compilers (which don't have many of those modern features).

That definitely ups the stakes on the "modern" approach a lot (like, in the limit case `#ifdef`-hell to get part way there).

There are firms that will sell you a suite of frontends supporting every C compiler back to the early 80s and integrate them into a modern toolchain, I used to work with an alum of such a firm and I gather it's great stuff. I also gather it costs whatever you can afford, so there's that. I forget the name of the company but I could ping my friend if that's interesting to you.

Worst case, you could not have to chase memory corruptions on the subset of your target platforms that LLVM targets.

Re: Safety: A comparaison between Rust, C++ and Go

#188

Post by touisteur »

benreesman wrote: post #186
touisteur wrote: post #185

Earlier quoted context omitted.

Oh I meant C++ binding was more of a pain before. I've been doing swig and other kinds of C FFI wrapping for years and this is far better... Of course it relies on the module/extension API from python that is quite amenable to this kind of full-object and their methods binding. But it works very well together. So much that we asked similar for Ada https://github.com/AdaCore/Ada-py-bind (Raphael Amiard from AdaCore is…

I have to admit to basically total ignorance of Ada. It's got a heritage around avionics-type stuff right, extreme low defect tolerance settings? Looks kinda like Pascal? Is it something that a true polyglot hacker needs to know? It's got important, novel ideas or unique applications that aren't addressed well by other tools? I love learning languages, but there are so many you'll never learn them all well.

It's my daily driver and I think one of the reasons my company can build very complex and high integrity systems with little staff. It's got a lot of nifty features and is still being updated to integrate more. I saw so many people very uninterested in hacking and programming, learning Ada and be so efficient with it so fast, with very few bugs, that there must be something there.

I'd say the driving principle is the language tries to have you write code that can be read easier, and is less concerned about helping you write millions lines of code per month. One example (when you get past the knee-jerk 'whoa it uses begin and end instead of braces') is generics where instantiation is mostly explicit (and thus can be painful to write) which helps reading, a lot. I'd downvote to hell any change to that (let the IDE/langserv generate the code for you, but please, generics are complex already).

The other driving principle is finding defects as soon as possible. So the compiler is harsh, there are lots of static checks. But it also helps you find defects at runtime as soon as possible. It can insert validity checks everywhere, if you can pay the runtime cost (hint: it's very rare you can't).

It has strong typing, very interesting typing features, no implicit conversion, most features you'd want in a modern language (tasking, OOP, generics, exceptions - erm...) and some that are more 'original' (contracts, quantifiers, if- and case-expressions, function arguments qualifiers in/out/in-out) and very nice union types (discriminated records).

Recently it has been extended to formal proof, with the SPARK language, which is Ada with some language features disabled and an automated proof environment (based on Why3 and SMT solvers), which is also its own interesting new tech, with interesting advances these last years (proof of floating point operations, memory ownership,...).

I think I could go on and on. But if you can spare one or two hours I'd just go to https://learn.adacore.com/courses/intro-to-ada/index.html and run the tutorial (all in the browser) and read a bit about all the features, and just ask questions downthread, I'll try to monitor it (like I don't already monitor obsessively all my HN comments...).

Post reply on HN