Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Rust is safe” is not some kind of absolute guarantee of code safety

lkml.org

Post reply on HN
Print view View original

31–40 of 542 posts

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#31

Post by a_humean »

pfortuny wrote: post #15
a_humean wrote: post #6

I know next to nothing about kernel programming, but I'm not sure here what Linus' objection to the comment he is responding to here is. The comment seemed to be making reference to rust's safety guarantees about undefined behaviour like use after free. Linus' seems to have a completely different definition of "safey" that conflates allocation failures, indexing out of bounds, and division by zero with memory safety.…

I am probably wrong but I understood that “safety meaning panic” is noeither “safe” not allowed in the Linux kernel because the kernel must not panic when an error arises.

Which is why Rust has been accommodating the kernel by adding non-panic versions of the functions that Linus has been complaining about (namely that memory allocation is infallible, because that isn't an unreasonable thing to assume in applicationc code.). Still doesn't change the fact that "safe" in this context has a technical meaning, and what Linus is describing isn't that.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#32

Post by layer8 »

dijit wrote: post #20
MarkSweep wrote: post #10

Why is panicing in the kernel on an error not an option? Like kernels can write a core dump and reboot, right?

if you panic and you're a kernel you very likely corrupt your filesystem, at the very least.

While I don’t advocate for kernel panics, journaling filesystems are a thing.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#33

Post by detaro »

darthrupert wrote: post #11
throwawaybutwhy wrote: post #2

To put things in context, Linus is being reasonable and wise and well-mannered once again. Wouldn't mind reading a few juicy expletives, to be honest.

I wonder if he'll end up regretting opening this particular Pandora's box or will things stabilize eventually.

What makes you expect it might not stabilize?

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#35

Post by mynameisvlad »

rat9988 wrote: post #4

I am the only one who would have a hard time to collaborate on a project where the "collaborators" start their message with > You need to realize that > (a) reality trumps fantasy ?

This is also the “toned down” version of Linus.

If he were any other person, he’d have been axed a long time ago for this behavior.

I don’t understand how people put up with this kind of toxicity, even from him.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#36

Post by dijit »

layer8 wrote: post #32
dijit wrote: post #20

Earlier quoted context omitted.

if you panic and you're a kernel you very likely corrupt your filesystem, at the very least.

While I don’t advocate for kernel panics, journaling filesystems are a thing.

Yes, but even then not all filesystems are journaled.

EFI is FAT, FAT is not journaled. You almost certainly have EFI these days.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#37

Post by 2OEH8eoCRo0 »

pca006132 wrote: post #29
MarkSweep wrote: post #10

Why is panicing in the kernel on an error not an option? Like kernels can write a core dump and reboot, right?

I guess when the kernel panics, there is nothing to write the core dump for you...

kdump

https://en.wikipedia.org/wiki/Kdump_(Linux)

He also mentions that programs can report problems automatically to the distro devs. For example:

https://retrace.fedoraproject.org/faf/problems/

A kernel dump is not something you always want to upload since it can be large and contain sensitive info. I'm not a kernel dev though.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#38

Post by detaro »

pca006132 wrote: post #29
MarkSweep wrote: post #10

Why is panicing in the kernel on an error not an option? Like kernels can write a core dump and reboot, right?

I guess when the kernel panics, there is nothing to write the core dump for you...

The kernel crash dump mechanism works by reserving some memory, which it boots a fresh copy of the kernel into on kernel panics, which then takes care of reading the old dead kernel from memory and saving the dump.

Of course this working requires the fresh kernel to be able to get up and do that without itself crashing, so it can't capture every scenario. And it is bringing down the system completely, and there's lots of pros and cons to be argued about that vs attempting to continue or limp along.

Re: “Rust is safe” is not some kind of absolute guarantee of code safety

#39

Post by mynameisvlad »

SanjayMehta wrote: post #28
rat9988 wrote: post #4

I am the only one who would have a hard time to collaborate on a project where the "collaborators" start their message with > You need to realize that > (a) reality trumps fantasy ?

You need to realise that (a) that's the creator of Linux (b) see (a) above

That shouldn’t excuse him from being a reasonably decent person to work with.

He gets a lot more leeway than being the creator of Linux should afford someone.

Post reply on HN