21–30 of 45 posts
We know how to write secure C/C++ code. The methods are very expensive and don't scale to large engineering teams.
Government agencies as well as large companies - including Microsoft and Google - have researched this very subject for decades. The problem is that even very small probabilities become a significant issue at scale.
There is such a thing as Rust fanaticism, people with a near-religious belief that Rust will solve all of coding's problems. You can identify them because they view use of unsafe as a great sin.
It seems he's arguing against the Rust fanatics, and not Rust programmers in general or the language itself.
The article contains several strawmen that aren't constructed particularly well even by strawmen standards. They're not even really knocked down. Just gently pushed where they lean against a nearby wall.
But if you go to the very end, then I think we can infer what's going on here:
> ... the growing movement toward legislation. [...] Because we could end up in a less secure future, where nobody understands why, with red tape that prevents you from finding out what went wrong.
Rust contains many low level details that you have to understand. And type inference, generics, associated types, two macro systems, algebraic data types (which have to concern themselves with low level details), pattern matching, and ownership and borrowing. It is hard to get up to speed with all of these concepts.
Compare that with python. With python you have to understand dictionaries and the call stack. That's about it (imagine me handwaving a bit).
Additional concepts that you have to understand in order to be productive (or get the job done at all) is a consideration that is worth making. However, having a hard time groking the affine types and the borrow checker isn't really an argument against Rust.
I'm not sure there's much to take away from this article. The author spends most of his words arguing against himself and then ends with a very confusing paragraph with a vague call to "understand what security means", a reference to "the growing movement toward legislation" (what legislation?), and the implication that we might be less secure, somehow. Maybe there is some subtext I'm supposed to know before reading,…
An example so you can see for yourself: https://www.nsa.gov/Press-Room/News-Highlights/Article/Artic...
But a far greater gain is that Rust is designed right from the start with tighter semantics which make it more suitable static analysis, and that it is, unlike C/C++, largely free of undefined behaviour.
If the author can use “C” to mean “C or C++” (WTF) then I’m going to use “Rust” to mean “any language designed to make it easier to write correct code”. Rust’s memory handling removes so many footguns like use-after-free that whole classes of exploits evaporate. Then it adds a type system that makes it hard to write whole classes of logic errors. For the encore: since a programmer knows that code that compiles cleanly doesn’t make those related mistakes, they can spend more of their time concentrating on algorithms and business logic instead of RAM bookkeeping and trying to remember whether the “x uint64_t” argument is supposed to be the file offset or the size of the data or the number of chickens to pack because they all use the same type.
I can write assembler. It’s fun. I’d hate to do more than a smattering of it for a living, because life’s too short to keep manually doing what a computer’s good at. Rust lets me think about what I’m doing instead of how I’m doing it, so instead of worrying about the trees I can make sure I’m taking care of the forest.
If you aren't particularly concerned about systems development or rubber-to-the-bare-metal performance then there are tons of options: managed languages. C#, Java, Go, etc.
If the article is advocating for C/++, please, stop. The claim that there are some safe programs in the world of C is categorically false. [Edit] for example, as soon as you use glibc: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=glibc
Earlier quoted context omitted.
This is a great summary-by-quote, I feel fully informed about what to expect if I actually would read the full source text, and based on this excellent summary I am confident I can save reading it for when I've run out of things argue about.
Would you say I'm being irrational by plucking this one quote out of the post?