Live data from Hacker News

Compiling C to Safe Rust, Formalized

arxiv.org

171–173 of 173 posts

Re: Compiling C to Safe Rust, Formalized

#171

In 2002, a group of researchers presented a paper on Cyclone, a safe dialect of C [1]. While (manually) porting code from C to Cyclone, they found safety bugs in the C code. These kinds of manual or automated conversation from C to therefore have potential not only for increasing adoption of safer languages but also for uncovering existing bugs. [1] https://www.researchgate.net/profile/James-Cheney-2/publicat...

> Cyclone is no longer supported; the core research project has finished and the developers have moved on to other things. (Several of Cyclone's ideas have made their way into Rust.) Cyclone's code can be made to work with some effort, but it will not build out of the box on modern (64 bit) platforms).

http://cyclone.thelanguage.org

Re: Compiling C to Safe Rust, Formalized

#172
post #146

Earlier quoted context omitted.

You also need to consider that formal verification is not the be-all/end-all of correctness. Formal verification is verifying a mathematical model of the program correct, according to certain mathematical correctness properties. That model may not actually represent the real world, or the correctness properties may not actually be the properties that you want to guarantee. Famously, there was the formally verified Ja…

The article talks about compiling formalized C code to Rust. While interesting from a tinkering perspective, I fail to see any significant utility in safety, security, readability, popularity and ease of language. Can you please educate me as to what I am missing

They have a library that allows you to write and verify formalized C code more easily. And they have actually written parsers for some common file formats in this, which have been used in some major projects; and that's good, because efficient parsers for complex file formats is one of the places where you really want to use C for its efficiency, but it's also really easy to make a mistake that leads to exploitable memory safety vulnerabilities.

Now that Rust is becoming more popular, it would be nice to be able to re-use these formally verified parsers in Rust, where your entire language is memory safe. The formally verified parsers can still be helpful, because the formal verification can ensure that you also won't crash (in safe Rust, you can still crash, you just won't be subject to arbitrary memory corruption).

But just using the C libraries from Rust is unsatisfactory, now you need to go through an unsafe interface which introduces a potential place to introduce new bugs. And there are existing C to Rust translators, but they generate unsafe Rust.

So this demonstrates a way to translate from C to safe Rust, though with constraints on the existing C code. It's both useful in that it means that you can translate some of these already formally verified libraries to safe Rust, and this research could be used as part of later work for a more general tool, that could potentially translate more C code to safe Rust while falling back to unsafe in cases that it can't reason about.

Anyhow, not all academic work like this ends up being used practically in the real world, but some of it can be, or some of it can be put into practice by other tools later on. Rust came about that way; much of its reason for existence is trying to put decades of academic research into a practical, real-world usable language, since there was lots of academic work that had never really been used in industry as much as it should be.

Re: Compiling C to Safe Rust, Formalized

#173

Earlier quoted context omitted.

With rust having recently entered the Linux kernel, Windows 11, qemu among others where Haskell never took a hold, I really fail to see where you feel the wind is blowing. The thing is, rust is used today in more and more places because it's reliable. We're not going to switch out the ground we are standing on every time something shiny comes along and that's why this is such an interesting development.

Just because you have tiny pieces being written in it doesnt mean its getting adopted. Its way too cumbersome to write entire OS in it - all the example projects like AWS Firecracker end up with tons of unsafes. And its runtime components for dynamic memory stuff eat into efficiency. Basically a more expansive and possibly ML powered valgrind can easily offer the same memory safety as Rust does, without the penalty o…

> Its way too cumbersome to write entire OS in it

Not at all. See https://www.redox-os.org/

and many more: https://github.com/flosse/rust-os-comparison

> all the example projects like AWS Firecracker end up with tons of unsafes.

That's a good thing. With rust you are explicit about unsafe.

> Basically a more expansive and possibly ML powered valgrind can easily offer the same memory safety as Rust does, without the penalty of slower development and efficiency hits

It is apparent that you have no experience from rust, and I wonder if you have used valgrind much too, as you seem unaware about the huge overhead from running your app through valgrind.

Rust's error messages are precise, while valgrind is a crapshow to work with, as you should know since you mentioned it?

> so Rust adoption is "unstable" i.e its just a nice improvement but not does not give a hard advantage in any form and way.

It's used in production in several high profile projects, some that I already mentioned. Apparently smart people do see advantages.

Post reply on HN