Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Rust is safe” is not some kind of absolute guarantee of code safety

lkml.org

Post reply on HN
Print view View original

61–70 of 542 posts

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#61

Post by coldtea »

>And the reality is that there are no absolute guarantees. Ever. The "Rust is safe" is not some kind of absolute guarantee of code safety. Never has been. Anybody who believes that should probably re-take their kindergarten year, and stop believing in the Easter bunny and Santa Claus.

I thought that he had apologised and regretted being hostile in comments. Apparently not. Not that I have much of an issue with ranty colorful language, but you need to also be right and have a legitimate cause to pull it off...

The point he makes is BS. "the reality is that there are no absolute guarantees. Ever" Yeah, DUH! The compiler could have bugs and soundness issues for example.

The point is you don't need "absolute guarantees" just "way safer and which dozens more classes of issues discovered automatically" is already enough. The other guy didn't write about "absolute guarantees". He said "WE'RE TRYING to guarantee the absence of undefined behaviour". That's an aim, not a claim they've either achieved it, or they can achieve it 100%

>Even "safe" rust code in user space will do things like panic when things go wrong (overflows, allocation failures, etc). If you don't realize that that is NOT some kind of true safely, I don't know what to say.

Well, if Linus doesn't realize this is irrelevant to the argument the parent made and the intention he talked about, I don't know what to say...

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#62

Post by dijit »

KMnO4 wrote: post #54
dijit wrote: post #36

Earlier quoted context omitted.

Yes, but even then not all filesystems are journaled. EFI is FAT, FAT is not journaled. You almost certainly have EFI these days.

EFI is read, but not frequently written.

I'm not sure why that's relevant.

It will be written to on every kernel update and every initramfs update at least, which is what.. once a week on average?

A reply like yours is not so subtly indicating that "it's fine to panic all the time because ultimately you might be fine if you get a panic", which I fundamentally disagree with, other concerns aside.

Also you're suggesting that journaling filesystems are perfect and never lose data, which is also very untrue, in the default case they only protect metadata but there are still circumstances where they can lose data anyway; they're more resilient, not immune.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#63

Post by arinlen »

a_humean wrote: post #6

I know next to nothing about kernel programming, but I'm not sure here what Linus' objection to the comment he is responding to here is. The comment seemed to be making reference to rust's safety guarantees about undefined behaviour like use after free. Linus' seems to have a completely different definition of "safey" that conflates allocation failures, indexing out of bounds, and division by zero with memory safety.…

> I know next to nothing about kernel programming, but I'm not sure here what Linus' objection to the comment he is responding to here is.

You should read the email thread, as Linhas explains in clear terms.

Take for instance Linus's insightful followup post:

https://lkml.org/lkml/2022/9/19/1250

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#64

Post by Tomte »

I actually wondered with all the recent "Rust in the kernel" about culture clashes. I mean, most kernel developers aren't Rust programmers (and vice versa).

Now we got a first glimpse at what happens.

Still, I find it strange that it never seemed to come up in preparation to the first Rust merges. Were there any conflict resolution strategies in place (that I don't know about) or just "we flame it out on LKML"?

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#65

Post by mid-kid »

mynameisvlad wrote: post #58
zo1 wrote: post #50

Earlier quoted context omitted.

Then it's probably not the place for you, or people with thin skin that don't want to deal with that kind of tone/communication. If they lose out on talent because of it, that's their loss. Not every project has to be perfect and all-inclusive to the entire world of developers, and I'm okay with that.

It’s crazy to think that advocating for reasonable, non-toxic people to work with receives this kind response. Inclusivity and non-hostile work environments should not be considered “perfect” and “all-inclusive”. They should be basic . The default . The lowest bar possible .

Just as many people have problems with this form of communication, many people find it hard to clearly express themselves in an environment where they're expected to put people's feelings above all else. What some might perceive as "hostile", others would simply call "honest". It's simply a matter of preference.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#66

Post by analognoise »

atoav wrote: post #16
tcfhgj wrote: post #7

> Not completing the operation at all, is not really any better than getting the wrong answer, it's only more debuggable. Wouldn't be that sure about that. Getting the wrong answer can be a serious security problem. Not completing the operation... well, it is not good, but that's it.

I mean if it is a cosmetic thing sure. If it has substantial meaning I would rather have that 5 ton robotic welding arm not move than have it move through my skill. It is sometimes acceptable to get wrong output. But is nearly always better to know it is wrong.

This sounds like the difference between "fault tolerant" and "fail safe".

Fault tolerant - you get a fault, you keep moving.

Fail safe - you fail, and thus all operations are stopped.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#67

Post by Ygg2 »

2OEH8eoCRo0 wrote: post #24
staticassertion wrote: post #14

> Even "safe" rust code in user space will do things like panic when things go wrong (overflows, allocation failures, etc). If you don't realize that that is NOT some kind of true safely, I don't know what to say. When people say "safe" there's a pretty precise meaning and it's not this. Yes, anyone who believes rust is 100% "safe" (by any definition) is wrong. That's not something you learn in Kindergarten though, i…

One of my Marine NCOs would say, "there is no such thing as safe." You aren't safe on the FOB, in your car, in your barracks, or in your house. There are only degrees of safety. Very wise almost globally applicable words.

> There are only degrees of safety.

Sure but people use this logic to justify no safety. Find me a marine a that goes into war totally naked.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#68

Post by sidlls »

kweingar wrote: post #47

Classic Linus. From the closing paragraph, I feel like he’s under the impression that Rust-advocating contributors are putting Rust’s interests (e.g. “legitimizing it” by getting it in the kernel) above the kernel itself.

They probably are, in many cases. Rust’s community, in aggregate, have developed a reputation (earned, in my opinion). It’s too bad that the community don’t follow the leaders’ example in this regard. There are some quality, level-headed Rust advocates. They appear to be the minority.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#69

Post by bitexploder »

aaaaaaaaaaab wrote: post #60
kweingar wrote: post #47

Classic Linus. From the closing paragraph, I feel like he’s under the impression that Rust-advocating contributors are putting Rust’s interests (e.g. “legitimizing it” by getting it in the kernel) above the kernel itself.

Is he wrong?

Does it even matter? Rust does what it does and it was enough of a benefit to include in the kernel. It is a big accomplishment.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#70

Post by ukweld »

coldtea wrote: post #61

> And the reality is that there are no absolute guarantees. Ever. The "Rust is safe" is not some kind of absolute guarantee of code safety. Never has been. Anybody who believes that should probably re-take their kindergarten year, and stop believing in the Easter bunny and Santa Claus. I thought that he had apologised and regretted being hostile in comments. Apparently not. Not that I have much of an issue with ranty…

Why are so many people criticizing Linus? This post strikes me as relatively moderate.

Other software dictators do exactly the same, but in a more underhanded and bureaucratic manner, which is worse. Yet their disciples call them "benevolent".

I can deal with Linus, but not with the latter. Linus strikes me as not being really serious or vindictive. It's just a colorful way of expressing himself.

Post reply on HN