Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sealed Rust Update

ferrous-systems.com

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Sealed Rust Update

#21

Post by mikekchar »

saurik wrote: post #19
chrismorgan wrote: post #14

Earlier quoted context omitted.

Speaking bluntly: Almost everyone using the language at present is getting by just fine without this. As a normal Rust developer, I don’t particularly care about a formal language specification existing. It’s a long way down my list of nice-to-haves—yeah, it would be nice to have, but there are quite a few other things that would be more nice to have. The core team are compiler and language developers. I’d much rathe…

I think the argument is that if you said that about C++ everyone would be "yeah: this is just a useful tool, so why do I care?"... but Rust is about safety, and if you don't have a formal model of the language by what reasoning could you possibly have to know it is safe? (And, in fact, every now and then--much less often these days, but still--someone finds a soundness issue in Rust itself, something you would hope t…

I know that "Rust is about safety" is the message that gets out, but I don't think it really is. At least, not any more than "Haskell is about safety". Rust is really about zero cost abstractions, IMHO. The borrow checker is a tool that allows you to work towards memory safety with zero cost abstractions. As a Rust developer, I'm actually much less worried about safety than I am about the zero cost. Rust allows me to achieve that zero cost without blowing up in complexity (which is sometimes hard to believe when you are wrestling with a borrow checker problem ;-) ).

Having said that, I'm totally happy if there can be formal verification of these things. However, I certainly don't consider it to be job 1.

Re: Sealed Rust Update

#22

Post by synack »

sgift wrote: post #17
analognoise wrote: post #8

I don't get why there is so much love for Rust but so little love for Ada?

Did Ada - or rather its proponents - make any effort to get people to learn it? If I google for "Ada programming language" I do not even find what could be an official site? I thought it could be adacore.com, but that's a commercial offering. Wiki tells me it could also be adaic.org, which errors out with "SSL_ERROR_UNSUPPORTED_VERSION" in current Firefox. Even if I could access the site: Would I find tutorials? Othe…

Agreed, Ada's documentation is sparse and hard to find. Unfortunately, the best resource I've found for learning it from the ground up is the textbook "Programming in Ada 2012" by John Barnes. It's a bit pricey, but the core of the language hasn't really changed since Ada 95, so a used copy of an old edition will get you started.

AdaCore's got some decent learn-by-example stuff here, but it doesn't cover every aspect of the language. https://learn.adacore.com/courses/intro-to-ada/index.html

Wikibooks has a pretty comprehensive book on Ada Programming, but there are still a lot of missing pages. https://en.wikibooks.org/wiki/Ada_Programming

Finally, the language reference covers everything, but it's formatted in the most unusable and difficult to search way I've ever seen. The source files for the reference are maintained by a single editor who invented his own markup language and parser for converting that into HTML and PDF. That may have been acceptable in 1995, but it provides a significant barrier to adoption today. I've made a few attempts at coercing these sources into docbook, but so far I've found I'm not clever enough to untangle this mess. http://www.ada-auth.org/standards/ada12.html

So yeah, just buy the textbook... Skip the first few chapters, they're basically just advertising that tells you how great the thing you're about to learn is, which I find to be in poor taste.

Re: Sealed Rust Update

#23

Post by chrismorgan »

saurik wrote: post #19
chrismorgan wrote: post #14

Earlier quoted context omitted.

Speaking bluntly: Almost everyone using the language at present is getting by just fine without this. As a normal Rust developer, I don’t particularly care about a formal language specification existing. It’s a long way down my list of nice-to-haves—yeah, it would be nice to have, but there are quite a few other things that would be more nice to have. The core team are compiler and language developers. I’d much rathe…

I think the argument is that if you said that about C++ everyone would be "yeah: this is just a useful tool, so why do I care?"... but Rust is about safety, and if you don't have a formal model of the language by what reasoning could you possibly have to know it is safe? (And, in fact, every now and then--much less often these days, but still--someone finds a soundness issue in Rust itself, something you would hope t…

I care about Rust’s safety. It’s what let me confidently use Rust instead of Python or JavaScript, where I had never felt comfortable with C or C++.

But the safety that Rust has already is good enough for me. I know that soundness holes exist (c.f. https://github.com/rust-lang/rust/labels/I-unsound%20%F0%9F%...), but they are very few, and if they’re realistic (most of those are possible but difficult to trigger and very unlikely to be encountered by real code) they get knocked down very quickly.

Frankly I think you’re overhyping the benefits of a formal model (in practice I believe it’s normally only certain subsets of popular compilers that are ever formally verified), underestimating the pernicious presence of bugs even with formal verification, and overvaluing the significance of the remaining 0.00000001% of safety to a working programmer.

In line with what mikekchar says, I care about performance and such things more than I care about formal verification of Rust’s safety.

I’m happy to hear about this stuff, but I don’t expect it to personally affect me, for the better or for the worse.

Re: Sealed Rust Update

#24

Post by brmgb »

analognoise wrote: post #8

I don't get why there is so much love for Rust but so little love for Ada?

Ada get plenty of love where it matters : actual industrial usage in critical systems.

It is not clear to me how the internet hype surrounding Rust which seems mostly driven by people coming from dynamic languages and former web developers actually translate to use where it counts.

Re: Sealed Rust Update

#25

Post by Argorak »

xvilka wrote: post #11

I am surprised they didn't mention Iris[1] and RustBelt[2] projects. Iris works on creating the formalization framework based on separation logic and Coq. They have the Rust code model specifically[3]. [1] https://iris-project.org/ [2] https://plv.mpi-sws.org/rustbelt/ [3] https://gitlab.mpi-sws.org/iris/lambda-rust

This is mainly a lapse. Thanks for highlighting them, they do awesome work!

They are also not quite what Sealed Rust is about. RustBelt is about formally verifying Rust and improving the understanding of the language.

Sealed Rust is mainly about the industrial adoption process. It's not meant as a replacement or competing project, quite the contrary: RustBelt existing is a huge motivator and a major stepping stone to build on.

We are also personally in touch through the Rust project.

Re: Sealed Rust Update

#26

Post by Argorak »

_bxg1 wrote: post #10

This is an important effort, but it's weird (disconcerting?) to me that something so fundamental as a formal language specification (for a language that advertises safety as a key feature) is being bootstrapped not by the core team, but by a third party. It doesn't feel like that's something you only need "collaboration with" the core team about. I can't think of anything that's more "core". The rest of it makes sens…

> This is an important effort, but it's weird (disconcerting?) to me that something so fundamental as a formal language specification (for a language that advertises safety as a key feature) is being bootstrapped not by the core team, but by a third party. It doesn't feel like that's something you only need "collaboration with" the core team about. I can't think of anything that's more "core".

This may be a misunderstanding about what Rust core does: it's a project steering committee. The specification work would have to be done by lang and compiler.

The Rust language specification is notoriously informal, as many of the current investors in Rust don't care _that strongly_ about it, at least not in the rigorous sense that certification needs. Major features are built by those investors.

Sealed Rust is an initiative to collect the stakeholders in having a proper specification happening.

Rust has always evolved on stakeholder needs, with those stakeholders providing the work either through staffing engineers or by funding engineers on the relevant teams and often relies on outside engineering/contribution. This is not _as_ different.

So, see it this way: we want Safety Critical Rust to happen. For that, we need some form of specification. We're willing to get a specification funded and contributed in a way that is useful to the project and doesn't tie it down.

Re: Sealed Rust Update

#27

Post by phaylon »

analognoise wrote: post #8

I don't get why there is so much love for Rust but so little love for Ada?

From my perspective, I'd say it's because there isn't much talk about Ada as a technology. It comes up a lot when Rust is discussed, but I never see details besides built-in ranges for numbers. I can't even remember ever hearing anything much about the library/tooling Ada ecosystem.

Also, Ada users seem to be more focused on technical content about safety/mission critical things, like this discussion. But this is a meta-area where no specific features or solutions are in focus. When there's a discussion about zero-copy parsing, compiler optimizations, platform support, scalability or any other everyday technical topic, noone knowing Ada seems to join in with their perspective and experience.

So my advice to the Ada community would be to talk more details, talk more about what you love. Tech is a big field and it's currently a lot of work to get to know Ada from the outside.

Re: Sealed Rust Update

#28

Post by Argorak »

brmgb wrote: post #24
analognoise wrote: post #8

I don't get why there is so much love for Rust but so little love for Ada?

Ada get plenty of love where it matters : actual industrial usage in critical systems. It is not clear to me how the internet hype surrounding Rust which seems mostly driven by people coming from dynamic languages and former web developers actually translate to use where it counts.

As someone who lead a lot of the talks hinted at in the blog post: it translates to where it counts.

I also see your devaluing of effective use of marketing and some peoples background on the internet. Memes like "InternetOfShit" wouldn't have happened if hardware builders would appreciate the skill sets of web engineers (e.g. running applications that are constantly under automatic attack).

Ada is still on the table though. In most places we spoke to that evaluated Rust as the next language, the other language on the table was Ada.

Re: Sealed Rust Update

#29

Post by Argorak »

analognoise wrote: post #8

I don't get why there is so much love for Rust but so little love for Ada?

There's still tons of love for Ada at all the places where we spoke to.

Rust, Swift, Nim, Zig and other languages are the driver of a current resurgence of debates around the embedded toolstack, though, which Rust leading the pack by having the most upfront "we want to talk" messaging.

Re: Sealed Rust Update

#30

Post by _bxg1 »

saurik wrote: post #19
chrismorgan wrote: post #14

Earlier quoted context omitted.

Speaking bluntly: Almost everyone using the language at present is getting by just fine without this. As a normal Rust developer, I don’t particularly care about a formal language specification existing. It’s a long way down my list of nice-to-haves—yeah, it would be nice to have, but there are quite a few other things that would be more nice to have. The core team are compiler and language developers. I’d much rathe…

I think the argument is that if you said that about C++ everyone would be "yeah: this is just a useful tool, so why do I care?"... but Rust is about safety, and if you don't have a formal model of the language by what reasoning could you possibly have to know it is safe? (And, in fact, every now and then--much less often these days, but still--someone finds a soundness issue in Rust itself, something you would hope t…

Not only that, it's much harder/impossible to implement an alternate compiler without a spec to go off of. C++ has multiple compilers which really benefits the ecosystem in various ways; until we have a spec, there's just rustc.
Post reply on HN