Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcome to Comprehensive Rust

google.github.io

Post reply on HN
Print view View original

181–190 of 204 posts

Re: Welcome to Comprehensive Rust

#181

Post by galangalalgol »

eggy wrote: post #173
galangalalgol wrote: post #135

Earlier quoted context omitted.

People have picked stranger things than julia for safety critical control systems. I know people have generated it from simulink and have used labview, and it wouldn't surprise me if somewhere someone is using an excel macro to control the pressure system on a boiler... The world is a scary place. Reading theough the spark tutorials and examples seems fairly similar to the rustlings excercise. I find the ways spark p…

SPARK is expressive and it has a formal specification from the get go that makes it easier to stay within the requirements and provides automatic verification. GNAT tools are pretty cool. I don't think Rust has much of this other than its specification. It has momentum and a great community, so I think either way it will succeed in many endeavors. Like Erlang for distributed computing, I think SPARK has carved out an…

I'd say most of the truly safety critical control code I encounter was generated in simulink, and the remainder is all in subsets of c++. Some of that c++ was loosely ported from ada (not spark) long ago. So rust wouldn't be taking over the domain from spark, it would be taking it over from c++ and simulink which took over half of the safety critical domain some years ago, many years if you count misra c. I would certainly advocate for spark over any of those languages, but that is a hard sell as people want free open source tooling that is used by google or amazon, and if they say no to spark, but yes to rust, well at least it isnt c++98 anymore. Or simulink models version controlled using folders with dates in the names.

Re: Welcome to Comprehensive Rust

#182

Post by bobajeff »

eggy wrote: post #170
bobajeff wrote: post #150

Earlier quoted context omitted.

I've looked a tiny bit into Ada and I like the language. I particularly like the pascal-like syntax and the ranges feature. However I love rusts cargo and build system better than Alire. As Alire seems to bolted ontop of gprbuild. I also find it unfun to go back to forward declaration and definition (ads) files. It also seems to me the rust ecosystem has more libraries in things I'm interested in and better support f…

What libraries are you interested in that Rust has and other PLs do not? What is your main use of Rust? It all depends on what you are doing. I use Zig for fun game dev stuff, and not SPARK, but for the safety-critical control systems, it's SPARK, not Zig or Rust.

I'm using rust to develop a internet client. So I need libraries for gui; rust has many to choose from (I'm using gtk currently). I see a few that plan on supporting Android which I'd like to port to down the line. Of course rust has many networking libraries also so I feel covered there.

Safety is fairly important and I like ada/spark for that but rust's community seems to be farther along in terms of support for Android and looks way more active right now.

Re: Welcome to Comprehensive Rust

#183

Post by eggy »

galangalalgol wrote: post #181
eggy wrote: post #173

Earlier quoted context omitted.

SPARK is expressive and it has a formal specification from the get go that makes it easier to stay within the requirements and provides automatic verification. GNAT tools are pretty cool. I don't think Rust has much of this other than its specification. It has momentum and a great community, so I think either way it will succeed in many endeavors. Like Erlang for distributed computing, I think SPARK has carved out an…

I'd say most of the truly safety critical control code I encounter was generated in simulink, and the remainder is all in subsets of c++. Some of that c++ was loosely ported from ada (not spark) long ago. So rust wouldn't be taking over the domain from spark, it would be taking it over from c++ and simulink which took over half of the safety critical domain some years ago, many years if you count misra c. I would cer…

SPARK being a derivative of Ada, which appeared over 40 years ago, inherits its legacy, so I would say it is older than its 2014 name tag. It was based on the Ada 2012 specification. Contracts are relatively new, but it has many real world mission critical applications in its portfolio other than the CubeSat program I put forth from 2013[2]. Rust wasn't even two years old at that point.

If you go back, then assembly was mainly used in mission critical software in aerospace, for example the Apollo guidance system. To quote an article about NASA programmer, Ron Garret about options in 1988[1] and the now-famous Lisp troubleshooting from 150 million miles away:

“There is Pascal and C and Basic and machine code. And that’s pretty much it in terms of popular languages. To get anything done in any of those languages is just really, really hard.” The code for most spacecraft ended up being written in assembly language.

I want free too, but tooling makes the system, and in SPARK2014 it is the tooling, not just the formally verified spec. of the PL that makes it really groove. Rust has a great build system in Cargo, but it does not have 10% of what SPARK2014/Ada/GNAT provide as an ecosystem and apps under its belt. I do think there are people working on this for Rust (Ferrous Systems with AdaCore), but I want to ship a product before that will ever happen. Maybe my next project will be Rust or Zig with contracts or April (Lisp and APL - my favorite, although there is BQN implemented in Rust!)

[1] https://thenewstack.io/nasa-programmer-remembers-debugging-l...

[2] https://en.wikipedia.org/wiki/SPARK_(programming_language)#I...

Re: Welcome to Comprehensive Rust

#184

Post by micronian2 »

eggy wrote: post #86

I still play with Rust (and Zig), but I have decided to put my work efforts into SPARK[1], the subset of Ada, for high-integrity software and formal verification. I know AdaCore and Ferrous Systems are collaborating in trying to bring a lot of Ada/Spark's capabilities to Rust, but this is still going to be some time. Ada has a longer legacy in this game. I am working on safety critical control systems and there is a…

Hi,

Regarding the collaboration between AdaCore and Ferrocene, the effort is to produce a Rust toolset that is qualified for safety critical usage (e.g. verification of object code that is produced, etc). That is _not_ the same as bringing SPARK-like language capabilities to Rust. I think too many people get that confused.

Re: Welcome to Comprehensive Rust

#185

Post by pjmlp »

adwn wrote: post #179
pjmlp wrote: post #164

Earlier quoted context omitted.

Not in the age of microservices. Language constructs only help if there are no other applications accessing the same resources.

> Not in the age of microservices. There's a huge world outside of microservices. > Language constructs only help if there are no other applications accessing the same resources. You're mistaken. Rust's language constructs can often help you write safe wrappers around inter-process communication and synchronization mechanisms. Of course, all bets are off if the other processes don't adhere to the agreed-upon IPC prot…

That is indeed the point, as most projects don't use a single language in isolation.

Re: Welcome to Comprehensive Rust

#186

Post by nequo »

eklavya wrote: post #132
candiddevmike wrote: post #103

Earlier quoted context omitted.

I get those with Go and I have blazing fast compile times too.

Really? Do you get compile time deterministic memory management while being much more high level than Go? There are trade-offs, rust makes one, use it if it makes sense but these comparisons are just pointless. This whole thread is filled with such arguments. Sure use OCaml, Haskell, Go whatever suits your needs. But let's not pretend that they achieve at compile time what rust does. Somebody is complaining about com…

> Sure use OCaml, Haskell, Go whatever suits your needs. But let's not pretend that they achieve at compile time what rust does.

Are you talking specifically about the memory use of rustc vs. ocamlopt? Or do you mean that rustc is faster than ocamlopt at compiling a similar program? Or are you saying that rustc does more work than ocamlopt because of the borrow checker?

Re: Welcome to Comprehensive Rust

#187

Post by ngrilly »

jfmc wrote: post #151
ngrilly wrote: post #140

Earlier quoted context omitted.

I started working with functional safety only two years ago, and I've been surprised when colleagues expressed that Simulink was actually the go-to solution for functional safety software where they were working before. The logic being that the Simulink toolchain is qualified for functional safety, and if you use it in combination with a qualified C toolchain and RTOS, then you're good to go, certification-wise.

My impression when working with people using Simulink is that 'safety' is much weaker that for people working on formal methods, and certification limited a lot the kind of programs that they would write. It made totally sense for their domain, but -- as a general practice to write software -- it didn't impress me at all. I may be wrong.

I was expecting functional safety standards to require the use of formal methods, similar for example to how AWS uses TLA+, but I was surprised to discover it was not a requirement at all.

Re: Welcome to Comprehensive Rust

#188

Post by slim »

jjgreen wrote: post #52
kibwen wrote: post #31

Earlier quoted context omitted.

Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.

Actually no, one can detect curl-piping server-side and serve hostile blobs only to those foolish enough to do so: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

also by doing that you don't keep a copy of the script for investigation if something smells fishy later

Re: Welcome to Comprehensive Rust

#189

Post by incrudible »

rapsey wrote: post #149
candiddevmike wrote: post #103

Earlier quoted context omitted.

I get those with Go and I have blazing fast compile times too.

Go is not a C/C++ replacement. Rust is.

Rust is its own thing that may share some niches with cpp, but it does not replace it. I would really have to care about memory safety a lot to pick Rust over Zig (for example) as a cpp alternative, but then if I really care about memory safety I might pick something other than Rust as well. When it comes to performance, you will probably end up needing unsafe anyway, which raises the question of why you should write an entire application in Rust as opposed to mixing a simpler and slower safe language with a simpler unsafe language for performance.

Re: Welcome to Comprehensive Rust

#190

Post by yencabulator »

kibwen wrote: post #75
sofixa wrote: post #66

Earlier quoted context omitted.

You meant a binary blob in your distro's repository, so one that was checked, tested, approved and verified with a hash. Which is wildly different than downloading and running random binaries or scripts for that matter off the internet.

No, it's hardly random, it's an official binary provided the Rust project from an official domain managed by the Rust project. If you don't trust it, then you shouldn't trust the Rust source code either.

In this case, the Google internal course explicitly does not trust that random shell script, even if it came from rust-lang.org, while their internal apt repository is trusted. See https://news.ycombinator.com/item?id=34092187
Post reply on HN