Live data from Hacker News

Memory safety absolutists

itsallaboutthebit.com

111–120 of 272 posts

Re: Memory safety absolutists

#111
post #46

How is this better than the GC in D?

It is better in a sense that D is not C or C++. Technical innovation is memory safety with high level of compatibility with existing C and C++ in practice. It is compatible enough that you can run memory safe LibreOffice with Fil-C. D doesn't do that.

Re: Memory safety absolutists

#112

Earlier quoted context omitted.

I think this crate description encapsulates what's difficult about unsafe rust, which is how unergonomic pointers are. Like why do I need to use `addr_of_mut!`? I'm sure there's a good reason, as Rust tends to think these problems through, but it's very unintuitive compared to returning `&mut`. I feel like I'm juggling way more concepts, which to be fair helps with safety, but it can obscure the algorithm itself. Doe…

> Like why do I need to use `addr_of_mut!`? As of Rust 1.82.0 [0] you no longer need to! > I'm sure there's a good reason, as Rust tends to think these problems through, but it's very unintuitive compared to returning `&mut`. The addr_of_mut docs [1] give a pretty decent explanation of its reason for existence; in short, it lets you get a pointer to something without needing to create potentially-invalid intermediate…

Interesting. I stopped working with Rust about two years ago, so it looks like there's been a lot more polish in these areas.

Re: Memory safety absolutists

#113

The main problem of Fil-C or similar solutions is not that they provide absolute safety with no escape hatch (unlike languages with unsafe keyword). The problem is that they provide an excuse to keep using terrible programming languages like C and C++ allowing memory safety issues in the first place.

Yeah, but who's going to rewrite LLVM in Rust, which rustc relies on?

Yes there is Cranelift, and?

Re: Memory safety absolutists

#114

The problem with this post is the extent to which it shows that its author has an unhealthy obsession with me personally. It’s weird but also oddly flattering. I don’t dislike Rust, and when I point out that Rust is not fully memory safe, it’s because I find the details here super interesting. It’s interesting that Rust deliberately chooses to have an unsafe subset. It’s interesting how that leaks out to the rest of…

> I don’t dislike Rust As someone who really enjoys seeing all of the different programming languages and their approaches to different problems, it’s becoming obnoxious to hear the constant battles among people who think programming languages need to become part of your identity. The endless battles of superiority and tit-for-tat responses feel petty and distracting. It’s refreshing to get back to people who just wa…

We did that to ourselves, picking languages like football memberships assigned at birth, with religious fights on the playground.

Not only languages, editors, OS, hardware platform,...

Because when it comes to apply for a job, the HR drones don't understand that one can manage to program in more than one language, use more than a specific OS, and so forth.

It was to be those specific bullet points, and by the way at least during the last five years exactly before applying to the position.

There are also the trivia questions during the interview about obscure language features.

So this naturally spills into one's identity, going back to the primitive mind of the days humans lived in small groups and it was us versus them across all tribes.

Which for those of us that are generalists, is a big pain in some body part.

Re: Memory safety absolutists

#115

Earlier quoted context omitted.

I think this crate description encapsulates what's difficult about unsafe rust, which is how unergonomic pointers are. Like why do I need to use `addr_of_mut!`? I'm sure there's a good reason, as Rust tends to think these problems through, but it's very unintuitive compared to returning `&mut`. I feel like I'm juggling way more concepts, which to be fair helps with safety, but it can obscure the algorithm itself. Doe…

> Like why do I need to use `addr_of_mut!`? As of Rust 1.82.0 [0] you no longer need to! > I'm sure there's a good reason, as Rust tends to think these problems through, but it's very unintuitive compared to returning `&mut`. The addr_of_mut docs [1] give a pretty decent explanation of its reason for existence; in short, it lets you get a pointer to something without needing to create potentially-invalid intermediate…

So how do I take a shared reference to a variable named "raw"?

Complicating the grammar for no good reason. This should have stayed a macro.

Re: Memory safety absolutists

#116
post #76

Once again, people are grappling with an axiomatic definition of "memory safety" and avoiding the fact that it's a term of art with a very specific meaning: comprehensive protection from The Memory Corruption Vulnerabilities, which include overflows, the lifecycle vulnerabilities like UAF and type confusion, and uninitialized variables. To the extent Fil-C and Rust both address these vulnerabilities, and don't includ…

Even within Rust some folks do this to themselves, misusing unsafe with code that is 100% safe Rust, only to taint code that should only be called in specific cases, completely unrelated to memory safety.

I never seen this happen with GC/RC languages that also support unsafe code blocks.

Re: Memory safety absolutists

#117

I was not aware of the antagonism from the Zig / Fil-C people to Rust, but it makes absolutely no sense. Like, of course you can prevent all memory safety errors by using a garbage collector. That has been known since the 90s. In fact, there was a good two decades after Java released where all the research on memory safety just stopped, because the standard answer became "use a GC". If you couldn't use GC, you were s…

> Like, of course you can prevent all memory safety errors by using a garbage collector. That has been known since the 90s.

Since the 60s actually, starting with Lisp, Scheme, CLU, Cedar, Smalltalk, Cedar,...

Re: Memory safety absolutists

#118
post #29

Earlier quoted context omitted.

> Like, of course you can prevent all memory safety errors by using a garbage collector. That has been known since the 90s. No, it's been known since GC was invented. > In fact, there was a good two decades after Java released where all the research on memory safety just stopped, because the standard answer became "use a GC". Having done all of my research on memory safety after Java was released, I find this stateme…

Yeah, my understanding (which is not from first-hand experience) is that a huge part of the origin of Rust was that there was a lot of research in memory safety techniques that had been going mostly unused by mainstream languages, so the idea was "Why not try to make a language using some of it?"

AT&T was already doing that as language to replace C, Cyclone.

AT&T even had a full OS, where C only had minor role, the microkernel and Dis VM/JIT, with the whole userpace implemented in Limbo, designed by the creators of UNIX and C.

Re: Memory safety absolutists

#119
post #118
post #29

Earlier quoted context omitted.

Yeah, my understanding (which is not from first-hand experience) is that a huge part of the origin of Rust was that there was a lot of research in memory safety techniques that had been going mostly unused by mainstream languages, so the idea was "Why not try to make a language using some of it?"

AT&T was already doing that as language to replace C, Cyclone. AT&T even had a full OS, where C only had minor role, the microkernel and Dis VM/JIT, with the whole userpace implemented in Limbo, designed by the creators of UNIX and C.

Good reminder that memory-safe alternatives to C aren't new. Rust may have won more because of ecosystem and timing than because it was the first to address the problem.

Re: Memory safety absolutists

#120
post #80

Earlier quoted context omitted.

Fil-C has a large performance impact though, and it'll always be reasonably significant. Rusts popularity has always been the combo of safety and performance, otherwise you might as well just use C#

> Rusts popularity has always been the combo of safety and performance, otherwise you might as well just use C# Combined with the ability to compile to a single native binary, having a solid package management solution, a fairly advanced type system, and a solid selection of nice language features. Usually you need to give up at least one of those.

> Combined with the ability to compile to a single native binary, having a solid package management solution, a fairly advanced type system, and a solid selection of nice language features

Good to see a praise for C#.

Post reply on HN