Live data from Hacker News

Was Rust Worth It?

jsoverson.medium.com

41–50 of 736 posts

Re: Was Rust Worth It?

#41

I never programmed in Rust, but I had enough experience in C programming to know that segmentation faults are annoying to debug. I heard Rust prevents memory management problems at compilation level, so it forces you to create safer program. Given this, I want to ask Rust programmers here: For people who have no experience in managing memory at coding stage (basically programmer who have no experience in C-like langu…

For people who've never written C or C++, Rust's biggest selling point is usually performance. Porting code from Python to Rust for example often gives 10-100x speedups right off the bat. You could get the same speedups by porting to C too, but Rust lets you do that without giving up the memory safety and package management convenience that you're used to.

Even when you don't care about performance, another issue that comes up sometimes is keeping track of mutable state. If you've ever relied on bytes instead of bytearray or tuple instead of list* to guarantee that no mutation is happening in some Python code, you know what I'm talking about. Rust can give you a similar level of control over who gets to mutate what, without making you change the type of your data or pay the cost of copies. It's basically the const/non-const distinction from C, but much stricter. Another way of saying the same thing is that Rust gives you a lot of the legibility/correctness benefits that you'd expect from a functional programming language, but you get to code in the usual imperative style.

* And even then, that only prevents assignment to the elements of the tuple. You can still mutate an element internally if it's not also an immutable type.

Re: Was Rust Worth It?

#42

I feel like Rust finally broke the idea that programmers should be in complete control and completely conscious of everything the compiler is doing. It hasn't been that way in decades, compilers are freaking magic. But Rust undid a lot of that with borrowing. People became comfortable with the compiler knowing better than them. I just wish we could relax further: We should never be explicitly iterating forward over a…

As someone who does a lot of unsafe rust, including tagged pointer foo, I strongly disagree.

If anything I want more explicit control, alleviated with an even more expressive type system. Ideally rusts type system would just be a prolog variant imho.

Re: Was Rust Worth It?

#43

As an outsider, I often hear about async Rust being less than ideal. Perhaps I don't understand, because I haven't dipped my toes in the water yet... but I do most of my work in Kotlin with Coroutines, and concurrency is everywhere in the UI. I can't imagine working in a language having a major deficit in this space. Are there any efforts to overhaul or completely rethink this?

It’s pretty much the same issue all languages have, that async functions are colored. I don’t think it is unique to rust.

Algebraic effects would solve this, but I don’t know any language other than OCaml that is working on that approach.

Re: Was Rust Worth It?

#45
post #9

Earlier quoted context omitted.

> Maybe it was a reaction against the Java-style reverse DNS notation I suspect it was less a reaction against anything and more just following the norms established by most other package managers. NPM, PyPI, RubyGems, Elixir's Hex, Haskell's Cabal... I'm having a hard time thinking of a non-Java package manager that was around at the time Rust came out that didn't have a single, global namespace. Some have tried to…

Yes, and all of those have had major security issues caused by their lack of foresight. "We're pretending security is not an issue." has been the feedback every time this is raised with the Cargo team. To be honest, it's turned me off Rust a little bit. The attitude of "Rust is memory-safe, so we don't need any other form of security." is not a good one.

> "We're pretending security is not an issue." has been the feedback every time this is raised with the Cargo team.

Do you have a specific link where I can read this response, because this is not at all the responses I have read.

Re: Was Rust Worth It?

#47
post #37

"Programming in Rust is like being in an emotionally abusive relationship. Rust screams at you all day, every day, often about things that you would have considered perfectly normal in another life. Eventually, you get used to the tantrums. They become routine. You learn to walk the tightrope to avoid triggering the compiler’s temper. And just like in real life, those behavior changes stick with you forever." This is…

It's a bit of an oversimplification, but a little quip I've used when talking about developing in Rust vs. other languages is, it's a question of where/when do you want the pain. In Rust, it's at development time (and hiring and ramp-up time); in C++ it's at runtime; and with GC languages it's at billing time when you have to pay for that extra compute and RAM. There's no way to get rid of the pain entirely.

Re: Was Rust Worth It?

#48
post #9

Earlier quoted context omitted.

> Maybe it was a reaction against the Java-style reverse DNS notation I suspect it was less a reaction against anything and more just following the norms established by most other package managers. NPM, PyPI, RubyGems, Elixir's Hex, Haskell's Cabal... I'm having a hard time thinking of a non-Java package manager that was around at the time Rust came out that didn't have a single, global namespace. Some have tried to…

> I'm having a hard time thinking of a non-Java package manager that was around at the time Rust came out that didn't have a single, global namespace The implication here is that namespaces in package managers weren't a known concept. Outside Java, NPM - probably the biggest at the time - not only supported them but was actively encouraging them due to collective regret around going single-global in the beginning. Co…

NPM added namespaces in version 2, which was released in Sep 2014, just 2 months before cargo was announced. I don't remember anyone making a big deal about using scopes in NPM for several years after that, it was just there as an option. The announcement blog post of v2 only gives two paragraphs to scoped packages and explicitly frames the feature as being for enterprises and private modules [0]:

> The most prominent feature driving the release of npm 2 didn’t actually need to be in a new major version at all: scoped packages. npm Enterprise is built around them, and they’ll also play a major role when private modules come to the public npm registry.

My memory is that the industry as a whole didn't really start paying attention to the risks posed by dependencies in package managers until the left pad incident.

To be clear, I'm not saying that it was a good idea to not have a better namespace system or that they were completely ignorant of better options, just that they were very much following the norms at the time.

[0] https://blog.npmjs.org/post/98131109725/npm-2-0-0.html

Re: Was Rust Worth It?

#49
post #20

Earlier quoted context omitted.

This needs to be resolved by every damned language. Just make signed dependencies a universal default, point to an https page for the package vendor and use the signing key from there. Neither node nor maven ever bothered to solve this, so we end up wandering the Wild West wondering when it will be that HR, or legal, or architecture comes knocking on the door to ask what we were thinking having a dependency on a dyna…

I don't think that's the real solution. Pay somebody either internally or externally to maintain a repo of all your dependencies and point your code at that. You won't get a left-pad incident. You won't get a malicious .so incident (unless you mirror binaries instead of source code). Like if you ran out of screws to make your product with do you walk around the street and scrounge up some? No, you go to a trusted ven…

I'm not suggesting scrounging.

I'm suggesting that the guys who've repeatedly proven themselves technically competent around security at scale might have a couple of useful ideas regarding how the industry might go about crawling its way out of this little security clusterfuck.

And perhaps even stop treating something as simple as a BOM as an enterprise feature, given that the overhead on such things is damned near zilch and the security implications are staggering.

https://www.cisa.gov/sbom

Re: Was Rust Worth It?

#50
post #37

"Programming in Rust is like being in an emotionally abusive relationship. Rust screams at you all day, every day, often about things that you would have considered perfectly normal in another life. Eventually, you get used to the tantrums. They become routine. You learn to walk the tightrope to avoid triggering the compiler’s temper. And just like in real life, those behavior changes stick with you forever." This is…

Indeed, I’ve been writing rust professionally since 2015 (yes before 1.0) and I would consider the first encounter with the compiler as maybe it yelling at me, because I was used to C++. But it actually taught me a lot about why the code I was writing may have seemed okay at first glance, but actually introduced a tricky corner case bug that I hadn’t considered. The borrow checker got it tho, and I had to rearchitect my code to avoid that edge case. Now the code is better, free of that bug, and I won’t make that mistake in the future.

Was that the result of a process in which the compiler “abused” me? I don’t think so.

Post reply on HN