Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Rust is safe” is not some kind of absolute guarantee of code safety

lkml.org

Post reply on HN
Print view View original

401–410 of 542 posts

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#401

Post by notacoward »

wtallis wrote: post #390
notacoward wrote: post #384

Earlier quoted context omitted.

Yeah, this part has never really been true. > In the kernel, "panic and stop" is not an option That's simply not true. It's an option I've seen exercised many times, even in default configurations. Furthermore, for some domains - e.g. storage - it's the only sane option. Continuing when the world is clearly crazy risks losing or corrupting data, and that's far worse than a crash. No, it's not weird to think all types…

> Furthermore, for some domains - e.g. storage - it's the only sane option. Can you elaborate on this? Because failing storage is a common occurrence that usually does not warrant immediately crashing the whole OS, unless it's the root filesystem that becomes inaccessible.

Depends on what you mean by "failing storage" but IMX it does warrant an immediate stop (with or without reboot depending on circumstances). Yes, for some kinds of media errors it's reasonable to continue, or at least not panic. Another option in some cases is to go read-only. OTOH, if either media or memory corruption is detected, it would almost certainly be unsafe to continue because that might lead to writing the wrong data or writing it to the wrong place. The general rule in storage is that inaccessible data is preferable to lost, corrupted, or improperly overwritten data.

Especially in a distributed storage system using erasure codes etc., losing one machine means absolutely nothing even if it's permanent. On the last storage project I worked on, we routinely ran with 1-5% of machines down, whether it was due to failures or various kinds of maintenance actions, and all it meant was a loss of some capacity/performance. It's what the system was designed for. Leaving a faulty machine running, OTOH, could have led to a Byzantine failure mode corrupting all shards for a block and thus losing its contents forever.

BTW, in that sort of context - where most bytes in the world are held BTW - the root filesystem is more expendable than any other. It's just part of the access system, much like firmware, and re-imaging or even hardware replacement doesn't affect the real persistence layer. It's user data that must be king, and those media whose contents must be treated with the utmost care.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#402

Post by geraneum »

layer8 wrote: post #136
geraneum wrote: post #128

Earlier quoted context omitted.

We cannot ensure that an arbitrary program halts by statically analyzing it. And it doesn’t have anything to do with the language of choice. https://en.m.wikipedia.org/wiki/Halting_problem

Proof assistants, which I expect to eventually merge with programming languages, can be used to restrict the set of programs you write to those where you can statically prove all properties you expect the program to hold. It’s not much different from what diligent programmers have always done in their head (with, of course, much more room for error). The fact that arbitrary programs are undecidable is a red herring h…

> Rust is arguably less safe in that aspect than C, due to the general Rust practice of panicking upon unexpected conditions

For clarification, I responded to this in particular because "safety" is being conflated with "panicking" (bad for kernel). I reckoned "Unexpected conditions" means "arbitrary programs", hence my response, otherwise you could just remove the call to panic.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#403

Post by topspin »

mustache_kimono wrote: post #396
topspin wrote: post #393

Earlier quoted context omitted.

> "If Rust people don't get this, we will have to part ways." What are you quoting? I don't see this anywhere in the thread. The nearest I see is: If you cannot get over the fact that the kernel may have other requirements that trump any language standards, we really can't work together. A reasonable, politely delivered, statement directed to an individual as opposed to Rust. It was in response to this rather cringy…

FWIW, I actually mostly agree with Linus. I was paraphrasing. I didn't want to write a page length comment, and won't here, but there were a few more instances of similar ultimatums (like "Or, you know, if you can't deal with the rules that the kernel requires, then just don't do kernel programming.") And all are similarly ridiculous/dickish. Really no need for such dramatic convulsions, Linus, where Wedson was simpl…

> I was paraphrasing.

You put it in quotes and didn't mention any paraphrasing. Linus didn't write it.

> Rust's UB guarantees

Can you point out the normative document that provides these guarantees? Rust doesn't have one as far as I know.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#404

Post by Yoric »

moldavi wrote: post #330
maxbond wrote: post #292

Earlier quoted context omitted.

I, too, have not encountered these toxic Rust fanboys. I don't believe my head is in the sand. I do regularly see people degrading Rust and it's community, and so am convinced these toxic Rust fanboys are largely a myth based on uncharitable interpretations of otherwise reasonable statements. I think people often read "I advocate for the deprecation of all C/C++ codebases" into the statement "Rust is a 'safe' languag…

I've seen both sides of this, as a Rust user and as a Go user. Rust users are generally friendly to one another, and to people who are interested in Rust. Hoever, some Rust users are toxic when talking to people outside the community or to people who disagree. That's why a lot of us (in the Rust community) don't notice it; we spend most of the time inside our own community talking to each other and being friendly to…

Fair enough.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#405

Post by mustache_kimono »

topspin wrote: post #403
mustache_kimono wrote: post #396

Earlier quoted context omitted.

FWIW, I actually mostly agree with Linus. I was paraphrasing. I didn't want to write a page length comment, and won't here, but there were a few more instances of similar ultimatums (like "Or, you know, if you can't deal with the rules that the kernel requires, then just don't do kernel programming.") And all are similarly ridiculous/dickish. Really no need for such dramatic convulsions, Linus, where Wedson was simpl…

> I was paraphrasing. You put it in quotes and didn't mention any paraphrasing. Linus didn't write it. > Rust's UB guarantees Can you point out the normative document that provides these guarantees? Rust doesn't have one as far as I know.

> You put it in quotes and didn't mention any paraphrasing. Linus didn't write it.

I think it's a fair characterization of what was said. Feel free, as everyone is, to read the entire thread again. I'm not a journalist. You have the primary source at your finger tips!

> Can you point out the normative document that provides these guarantees?

You're looking at the Rust reference right? https://doc.rust-lang.org/reference/behavior-considered-unde...

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#406

Post by gmueckl »

ok_dad wrote: post #369
voakbasda wrote: post #357

Earlier quoted context omitted.

That’s an odd thing to claim. I have worked on certified medical devices that run custom Linux distribution. Mind you, that experience also severely soured me on the quality of medical software systems, due to poor quality of the software that ran in that distribution. Linux itself was a golden god in comparison to the crap that was layered on top of it.

I'd like to hear more about that, but I assume it's much like the other poster here that described a Linux system that is a peripheral device attached to the actual medical device that does the medical shit.

It is not a peripheral device if it runs the UI with all the main controls, is it?

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#407

Post by topspin »

mustache_kimono wrote: post #405
topspin wrote: post #403

Earlier quoted context omitted.

> I was paraphrasing. You put it in quotes and didn't mention any paraphrasing. Linus didn't write it. > Rust's UB guarantees Can you point out the normative document that provides these guarantees? Rust doesn't have one as far as I know.

> You put it in quotes and didn't mention any paraphrasing. Linus didn't write it. I think it's a fair characterization of what was said. Feel free, as everyone is, to read the entire thread again. I'm not a journalist. You have the primary source at your finger tips! > Can you point out the normative document that provides these guarantees? You're looking at the Rust reference right? https://doc.rust-lang.org/refere…

> You're looking at the Rust reference right?

Not normative, as stated here[1], linked from the page you cite.

[1] https://doc.rust-lang.org/nomicon/index.html

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#408

Post by mustache_kimono »

topspin wrote: post #407
mustache_kimono wrote: post #405

Earlier quoted context omitted.

> You put it in quotes and didn't mention any paraphrasing. Linus didn't write it. I think it's a fair characterization of what was said. Feel free, as everyone is, to read the entire thread again. I'm not a journalist. You have the primary source at your finger tips! > Can you point out the normative document that provides these guarantees? You're looking at the Rust reference right? https://doc.rust-lang.org/refere…

> You're looking at the Rust reference right? Not normative, as stated here[1], linked from the page you cite. [1] https://doc.rust-lang.org/nomicon/index.html

Okay? Do you think you have you quibbled enough? To be clear, I still think it's fine for Wedson to inform him even if the document is not a normative reference/specification? Even if these are just the expectations of API/Rust users?

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#409

Post by topspin »

mustache_kimono wrote: post #405
topspin wrote: post #403

Earlier quoted context omitted.

> I was paraphrasing. You put it in quotes and didn't mention any paraphrasing. Linus didn't write it. > Rust's UB guarantees Can you point out the normative document that provides these guarantees? Rust doesn't have one as far as I know.

> You put it in quotes and didn't mention any paraphrasing. Linus didn't write it. I think it's a fair characterization of what was said. Feel free, as everyone is, to read the entire thread again. I'm not a journalist. You have the primary source at your finger tips! > Can you point out the normative document that provides these guarantees? You're looking at the Rust reference right? https://doc.rust-lang.org/refere…

> I think it's a fair characterization of what was said.

I think inventing Linus quotes is unfair.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#410

Post by mustache_kimono »

topspin wrote: post #409
mustache_kimono wrote: post #405

Earlier quoted context omitted.

> You put it in quotes and didn't mention any paraphrasing. Linus didn't write it. I think it's a fair characterization of what was said. Feel free, as everyone is, to read the entire thread again. I'm not a journalist. You have the primary source at your finger tips! > Can you point out the normative document that provides these guarantees? You're looking at the Rust reference right? https://doc.rust-lang.org/refere…

> I think it's a fair characterization of what was said. I think inventing Linus quotes is unfair.

Again, not a journalist? You/everyone are supposed to have read the primary source, as it's the linked subject of our discussion. I think whatever expectations of fairness we have for internet comments -- I have far exceeded them. And now we have your comment pointing out... whatever it is you wanted to point out. Reader beware!
Post reply on HN