Live data from Hacker News

“Rust is safe” is not some kind of absolute guarantee of code safety

lkml.org

531–540 of 542 posts

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#531
post #522

Earlier quoted context omitted.

Static analysis for C exists since 1979, date of lint's availability, the problem isn't lack of tooling, rather people actually using it.

I would assume that the things that lint could do you nowadays get by simply using -Wall -Wextra with gcc for example. While I haven't checked what a lint is required to do, but there have been plenty of situations in the past where I had to change my code in order to avoid triggering false positives from tests that run during normal compilation. For instance, there are tests that find accesses to potentially uniniti…

If we are talking about the 1979 version, most likely.

If we are talking about products like PC-lint, Sonar qube, Coverity, the experience is much more than that.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#532
post #235

Earlier quoted context omitted.

So instead of a power spike, we'd have had a major internet outage across the world, across the entire industry and beyond, probably, if everyone had panicked on oops. The blame really lies with people not monitoring their systems. As you said, you have the option to reboot on panic, but Linus is absolutely not wrong that this size does not fit all. What about a medical procedure that WILL kill the patient if interru…

You won't see Linux in those fields. I'm aware of a project by OSADL to qualify Linux for SIL 2, but your examples are way beyond that.

SUSE was used on Mars

https://www.pcmag.com/news/linux-is-now-on-mars-thanks-to-na...

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#533

Earlier quoted context omitted.

> Rust is not an absolute guarantee of safety and doesn’t protect us from all the bugs. That's not exactly the vibe I'm getting from the typical Rust fanboys popping up whenever there's another CVE caused by the usage of C or C++ though ;) Rust does seem to attract the same sort of insufferable personalities that have been so typical for C++ in the past. Why that is, I have no idea.

I wouldn't say the Rust community parallels the C++ community in any way. The rust community is more like the insufferable Haskell/FP community who, despite producing very little measurable commercial value continue to look down on everyone else. Indeed, there's a lot of damage control going on in this thread walking back Rust's guarantees of safety despite that, up until this point, being Rust's only real selling po…

> insufferable Haskell/FP community who, despite producing very little measurable commercial value continue to look down on everyone else.

I just took a break from creating measurable commercial value in Haskell.

Grab a Starbucks, shop at Target, or use Facebook recently?

Congrats, you used production Haskell code delivering measurable commercial value to you and millions of others.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#534

Earlier quoted context omitted.

> Haskell/FP community As someone who worked on a lot of OCaml projects, I would like to assure you that the issue really is the Haskell community which I too find completely unbearable. The rest of the FP community is far nicer/less smug. For a long time, they just thought it was a shame some innovative constructs seemed to be stuck in their favourite languages (first class functions, variant types, inference) and n…

To be fair, the Haskell hype train has long passed, and I never perceived the Haskell community as insufferable. They're just preconcerned formulating everything in way too mathsy frameworks to the point of being extremely inproductive as from a "real world" programmer's perspective.

> To be fair, the Haskell hype train has long passed, and I never perceived the Haskell community as insufferable. They're just preconcerned formulating everything in way too mathsy frameworks to the point of being extremely inproductive as from a "real world" programmer's perspective.

See my comment upthread, you seem to be misinformed on the use and prevalence of Haskell in the real world.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#535
Whenever people say things like "Use Rust, it's memory safe" I know that they're clueless. Nobody has shown any evidence that for the average project, written by average developers, writing in Rust won't result in just as many exploitable bugs as writing in C.

Also I had to laugh at this:

> No one is talking about absolute safety guarantees. I am talking about specific ones that Rust makes: these are well-documented and formally defined

As the saying goes "name three".

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#536
post #78

Earlier quoted context omitted.

I mean, it's felt like anytime anyone mentions any code base not written in rust, someone pops in and points out that it's not safe , and should be rewritten in rust. I think it's all part of the language maturing process. Give it time, zealots will either move on to something new (and then harass the rust community for not meeting their new standard of excellence) or simmer down and get to work.

Well they're right. Most code written in C is horribly unsafe. Most code written in Rust is very safe. No code is guaranteed to be 100% safe - not even formally verified code. There's a clear safety spectrum, with C near the bottom and Rust near the top. It's tedious for people to keep saying "well it's not right at the top so we should just keep using C". I'm sure pro-seatbelt people were called "zealots" back in th…

Rust isn't seatbelts, Rust is a tank. It's hard to steer, you need 4 people to operate it, but it's safe from bullets. It can also sink in quicksand or mud very easily. Rust advocates ignore the usability problems and say "Drive a tank everywhere, it's bullet-safe". Meanwhile the average programmer will get lost in the complexity of Rust and invent shortcuts like using unsafe {} in exactly the wrong place.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#537
post #102
post #74

Earlier quoted context omitted.

It's really common to see people say meaningless stuff like "Rust is a safe language" which is either deeply confused or deeply misleading. Rust provides certain guarantees of memory safety, which is great, but it's important to understand exactly what that means and not to oversell it.

It's an unproductive pedantry to expect every mention of the generalisation to be followed by a full disclaimer about exceptions and edge cases. People say "it's raining" without having to add "except under roofs".

This is the patronizing attitude that keeps getting Rust advocates into trouble. "I don't need to be pedantic, I know better than you, so I'll just simplify my argument down to the point that it's actually a lie, but you'll thank me later"

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#538

Earlier quoted context omitted.

Right. It's clear that many people have not heard of, or considered, Therac-25[1]. [1] https://en.wikipedia.org/wiki/Therac-25

Therac-25 removed redundancy. Quoting the Wikipedia article: "Previous models had hardware interlocks to prevent such faults, but the Therac-25 had removed them, depending instead on software checks for safety."

Right, that is the point I was making.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#539
post #497

Earlier quoted context omitted.

Linux has numerous CVEs, and a large percentage stem from memory corruption. That's not FUD, I'm afraid.

It's FUD. And not only that. The fear of constantly being attacked by an external entity is also paranoic.

Unfortunately, whether you personally care about this sort of thing isn't good enough anymore. Owned Linux boxes on IoT devices are now being marshaled into massive botnets used to perform denial of service attacks, while other vulnerabilities are exploited to enable ransomware. You having negligent security on your own unpatched box because you don't personally feel like it's a good tradeoff has many negative external consequences. Fortunately, the decision isn't actually up to you (and having fewer vulnerabilities won't influence you negatively anyway, so I'm not sure why you're so angry about it).

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#540

Earlier quoted context omitted.

Well they're right. Most code written in C is horribly unsafe. Most code written in Rust is very safe. No code is guaranteed to be 100% safe - not even formally verified code. There's a clear safety spectrum, with C near the bottom and Rust near the top. It's tedious for people to keep saying "well it's not right at the top so we should just keep using C". I'm sure pro-seatbelt people were called "zealots" back in th…

Rust isn't seatbelts, Rust is a tank. It's hard to steer, you need 4 people to operate it, but it's safe from bullets. It can also sink in quicksand or mud very easily. Rust advocates ignore the usability problems and say "Drive a tank everywhere, it's bullet-safe". Meanwhile the average programmer will get lost in the complexity of Rust and invent shortcuts like using unsafe {} in exactly the wrong place.

This runs contrary to my experience.

1. Coming from C++, my productivity is x2-x3 in Rust, making Rust a middle point between C++ and Python (about x8 productivity). What's more, if we factor maintenance time in, the lower costs of maintenance of Rust code makes the multiplier tend to x10, which is equal or better than Python (whose maintenance costs are important).

2. I have a colleague coming from Python (so a very different background than my C++ background), and he doesn't "get lost in the complexity of Rust" but after some use of Rust makes pretty much the same conclusions as I do: initial coding slower than Python, but roughly equal when you factor in maintenance time. He now writes the quick tools that could be Python scripts in the past in Rust when we suspect that they won't be one-off scripts (which happens very often). We get ease of distribution (static binaries), portability (to Linux and Windows), and better performance out of it too.

Although this is a comparison with C++ and Python, not C, the reasons why are simple and apply equally so to C:

1. Easy access to a good ecosystem. Adding dependencies in C or C++ is a pain. Very easy to do in Rust, preventing the need of reinventing the wheel (squarely). C suffers even more from this, given its lack of standard library and data structures (everything is a linked list :-D)

2. Memory safety and lack of UB in safe Rust brings a definitive simplicity in coding, code review and debug.

3. Result-oriented APIs and generally expressive type system are what end-up bridging the gap with Python with time.

What Rust definitely has is a learning curve. It is not optimized for taking the language without deep diving into it, or learning it in a short time. IMO it is a reasonable trade-off, given that the experience past the learning curve is so good, and that many of the things that make the learning curve so steep are integral to that experience (exclusive borrows, trait system, ...).

Post reply on HN