Live data from Hacker News

APT Rust requirement raises questions

lwn.net

361–370 of 508 posts

Re: APT Rust requirement raises questions

#361
post #326

Earlier quoted context omitted.

You can’t change things faster than persuading the people that maintain the things. Over-the-top evangelism doesn’t work well for persuasion.

That was probably a mischaracterization on my part. I wouldn't consider rewriting almost everything useful that's currently in C or C++ to be over the top. That would be a net good. Posts that say "I rewrote X in Rust!" shouldn't actually be controversial. Every time you see one, you should think to yourself wow, the software world is moving towards being more stable and reliable, that's great!

But it is nonsense. Every time some rewrote something (in Rust or anything else), I instead worry about what breaks again, what important feature is lost for the next decade, how much working knowledge is lost, what muscle memory is now useless, what documentation is outdated, etc.

I also doubt Rust brings as many advantages in terms of stability that people claim. The C code I rely on in my daily work basically never fails (e.g. I can't remember "vim" ever crashing on me in the last 30 years I use it). That this is all rotten code C that needs to be written is just nonsense. IMHO it would far more useful to invest in proper maintenance and incremental improvements.

Re: APT Rust requirement raises questions

#362
post #282

Earlier quoted context omitted.

>I know intellectually, that there are sane/pragmatic people who appreciate Rust. For the most part that is almost everyone who works on rust and writes rust. The whole coreutils saga was pretty much entirely caused by Canonical, The coreutils rewrite project was originally a hobby project iirc and NOT ready for prod. for the most part the coreutils rewrite is going well all things considered, bugs are fixed quickly…

It really makes me upset that we are throwing away decades of battle tested code just because some people are excited about the language du jour. Between the systemd folks and the rust folks, it may be time for me to move to *BSD instead of Linux. Unfortunately, I'm very tied to Docker.

Well, what's the alternative?

It is basic knowledge that memory safety bugs are a significant source of vulnerabilities, and by now it well-established that the first developer who can avoid C without introducing memory safety bugs hasn't been born yet. In other words: if you care about security at all, continuing with the status quo isn't an option.

The C ecosystem has tried to solve the problem with a variety of additional tooling. This has helped a bit, but didn't solve the underlying problem. The C community has demonstrated that it is both unwilling and unable to evolve C into a memory-safe language. This means that writing additional C code is a Really Bad Idea.

Software has to be maintained. Decade-old battle-tested codebases aren't static: they will inevitably require changes, and making changes means writing additional code. This means that your battle-tested C codebase will inevitably see changes, which means it will inevitably see the introduction of new memory safety bugs.

Google's position is that we should simply stop writing new code in C: you avoid the high cost and real risk of a rewrite, and you also stop the neverending flow memory safety bugs. This approach works well for large and modular projects, but doing the same in coreutils is a completely different story.

Replacing battle-tested code with fresh code has genuine risks, there's no way around that. The real question is: are we willing to accept those short-term risks for long-term benefits?

And mind you, none of this is Rust-specific. If your application doesn't need the benefits of C, rewriting it in Python or Typescript or C# might make even more sense than rewriting it in Rust. The main argument isn't "Rust is good", but "C is terrible".

Re: APT Rust requirement raises questions

#363

Earlier quoted context omitted.

> I love and use rust, it is my favorite language and I use it in several of my OSS projects but I'm tired of this "rewrite it in rust" evangilism and the reputational damage they do to the rust community. Thanks for this. I know intellectually, that there are sane/pragmatic people who appreciate Rust. But often the vibe I’ve gotten is the evangelism, the clear “I’ve found a tribe to be part of and it makes me feel s…

Much of the drive to rewrite software in Rust is a reaction to the decades-long dependence on C and C++. Many people out there sit in the burning room like the dog in that meme, saying "this is fine". Most of them don't have to deal at all directly with the consequences involved. Rust is the first language for a long time with a chance at improving this situation. A lot of the pushback against evangelism is from peop…

If you were right, then people should not be using Rust or C/C++. They should be using SPARK/Ada. The SPARK programming language, a subset of Ada, was used for the development of safety-critical software in the Eurofighter Typhoon, a British and European fighter jet. The software for mission computers and other systems was developed by BAE Systems using the GNAT Pro environment from AdaCore, which supports both Ada and SPARK. It's not just choosing the PL, but the whole environment including the managers.

This is an interesting read on software projects and failure: https://spectrum.ieee.org/it-management-software-failures

Re: APT Rust requirement raises questions

#364

Overall, I think Rust is probably too dangerous to introduce into core software. Every time there is a donation to the Rust Foundation, the Rust community is in an uproar that it is not a large enough fraction of gross revenue. Linux, apt, are all currently both free as in speech and free as in beer. If we have to start donating to the Rust Foundation a percentage of gross revenue for every tool that we use written i…

> Every time there is a donation to the Rust Foundation, the Rust community is in an uproar that it is not a large enough fraction of gross revenue. Where are you seeing this happen? I'm curious because I never have, which means that I'm missing out on discussions somewhere.

Sure, it's on Reddit /r/rust. I'll provide links at the end, but it happens every time there is a donation.

> > > Multi trillion dollar conglomerate invests a minuscule fraction of a fraction of their monthly revenue into the nonprofit foundation that maintains the tool that will save them billions

> > 115 Billion / 365 days / 1440 minutes = ~ 220k

> > So they make around 220k per minute, 350k in under 2 minutes. Still, any amount is better than nothing at all.

> I genuinely hate the thought of "Better than nothing". We should be saying "go big or go home."

Pretty popular thread. Approximate 900 upvotes over those three comments.

> That's like a millisecond of Google revenue.

and separately

> I mean thats nice. But in all honesty, is 1 Million still a lot?

That's from a while ago so it's smaller. But you can tell the sentiment is rising because these expressions of "it's not enough" are becoming more popular. Just a matter of time before the community tries to strong-arm other orgs with boycotts and this and that. We've seen this before.

> > Cool, but also depressing how relatively small these “huge” investments in core technologies actually are.

> Yeah, seriously. This is comparatively like me leaving a penny in the “take a penny leave a penny” plate at the gas station.

and separately

> Ah yes, the confidence displayed by allocating 0.0004% of your yearly revenue.

> Satya alone earns that in a 40 hr work week.

It's a pretty old playbook to use free-software language to get one's technology entrenched, then there's murmurs about how not enough money is being sent back to the people making it, the organization then uses the community as the stalking horse to promote this theory, and then finally comes the Elastic License relicensing.

Elastic did it. MongoDB did it. Hashicorp did it. Redis did it. I get the idea, but we should pre-empt the trojan horse when we see it coming. I know I know. You can fork when it happens etc. but I'm not looking forward to switching my toolchain to "Patina" or whatever they call the fork.

And if you think I'm some guy with an axe to grind, I have receipts for Rustlang enthusiasm:

https://news.ycombinator.com/item?id=24127438

https://news.ycombinator.com/item?id=24328686

https://news.ycombinator.com/item?id=30756184

https://news.ycombinator.com/item?id=37573389

https://news.ycombinator.com/item?id=41639619

List of donation posts follows:

https://old.reddit.com/r/rust/comments/1noyqak/media_google_...

https://old.reddit.com/r/rust/comments/1ajm56w/google_donate...

https://old.reddit.com/r/rust/comments/1cnehqt/microsofts_1m...

Re: APT Rust requirement raises questions

#365
post #297
post #271

Earlier quoted context omitted.

Fwiw, I didn't go looking for obscure examples to make HN posts. I've had three rounds of sincerely trying to really learn and understand Rust. The first was back when pointer types had sigils, but this exact declaration was my first stumbling block on my second time around. The first version I got working was `d`, and my first thought was, "you're kidding me - the right hand side is inferring it's type from the left…

> The first version I got working was `d`, and my first thought was, "you're kidding me - the right hand side is inferring it's type from the left?!?" I didn't learn about "turbo fish" until some time later. Tbh d strikes me as the most normal - right hand sides inferring the type from the left exists in basically every typed language. Consider for instance the C code some_struct a = { .flag = true, .value = 123, .st…

I see your point, and it's a nice example, but not completely parallel to the Rust/StandardML thing. Here, your RHS is an initializer, not a value.

    // I don't think this flies in C or C++,
    // even with "designated initializers":
    f({ .flag = true, .value = 123, .stuff=0.456});

    // Both of these "probably" do work:
    f((some_struct){ .flag = true, ... });
    f(some_struct{ .flag = true, ... });

    // So this should work too:
    auto a = (some_struct){ .flag = true, ... };
Take all that with a grain of salt. I didn't try to compile any of it for this reply.

Anyways, I only touched SML briefly 30 some years ago, and my reaction to this level of type inference sophistication in Rust went through phases of initial astonishment, quickly embracing it, and eventually being annoyed at it. Just like data flows from expressions calculating values, I like it when the type inference flows in similarly obvious ways.

Re: APT Rust requirement raises questions

#366
post #283

Earlier quoted context omitted.

Only `b` has the equivalent of "superfluous parens". It's practically your job to defend Rust, so I don't expect you to budge even one inch. However, I hate the idea of letting you mislead the casual reader that this is somehow equivalent and "just how languages work". The grammar could've used `Generic[Specific]` with square brackets and avoided the need for the turbo fish.

It hasn't been my job to work on Rust in for years now. And even then, it was not to "defend" Rust, but to write docs. I talk about it on my own time, and I have often advocated for change in Rust based on my conversations with users. If you're being overly literal, yes, the s are needed here for this exact syntax. My point was not about this specific example, it's that these forms are equivalent, but some of them ar…

> For this specific issue, if square brackets were used for generics, then something else would have to change for array indexing

The compiler knows when the `A` in `A[B]` is a type vs a variable.

Re: APT Rust requirement raises questions

#367

Earlier quoted context omitted.

All compilers do anyways is translate from one language specification to another. There's nothing magical about Rust or any specific architecture target. The compiler of a "memory safe" language like Rust could easily output assembly with severe issues in the presence of a compiler bug. There's no difference between compiling to assembly vs. C in that regard.

The assumption here is that there exists an unambiguous C representation for all LLVM IR bitcode emitted by the Rust compiler. To my knowledge, this isn’t the case.

One can do a direct translation from Rust AST/IR to C. Many functional languages do that, C++ started as a compiler to C.

Re: APT Rust requirement raises questions

#368

Earlier quoted context omitted.

Swift is as relevant to this discussion as Common Lisp.

On the contrary, Swift is very relevant on this subject. It has high feature parity with rust, with a much readable syntax.

It doesn't have the single feature that anyone cares about in Rust - compiler-enforced ownership semantics. And it's not in any way a system-level language (you couldn't use it without its stdlib for example, like in the Linux kernel).

The other features it shares with Rust are also shared by many other languages.

Re: APT Rust requirement raises questions

#369

Earlier quoted context omitted.

Syntax tends to be deeply personal. I would say the most straightforward answer to your question is "many people disagree that it is unreadable." Rust did build on the learnings of the past 20 years. Essentially all of its syntax was taken from other languages, even lifetimes.

The lifetime syntax was taken from OCaml but it has somewhat different semarics than OCaml. I honestly get a bit tripped up when I look at OCaml code (a language I'm a beginner at), and see ordinary parameterized types using syntax that suggests to me, from a Rust background, "woah, complex lifetime situation ahead!" I know that Graydon Hoare is a fan of OCaml and that it was a core inspiration for Rust, and I someti…

It's similar but different: both are type variables, but it's true that it's used for the "other" type variables in Rust.

For what it's worth, I am not even sure that Graydon was the one who introduced lifetime syntax. He was a fan of terseness, though: Rust's keywords used to be all five characters or shorter.

Niko and pcwalton were the ones working on regions, Niko talks a little bit about the motivation for syntax here: https://smallcultfollowing.com/babysteps/blog/2012/03/28/avo...

Later posts include /& as syntax: https://smallcultfollowing.com/babysteps/blog/2012/04/25/ref...

Eventually, another syntax: https://smallcultfollowing.com/babysteps/blog/2012/07/10/bor... which turns into a &x/ syntax: https://smallcultfollowing.com/babysteps/blog/2012/07/17/bor...

Which turns into this one, talking about variants of possible syntax: https://smallcultfollowing.com/babysteps/blog/2012/12/30/lif...

At some point, we get the current syntax: https://smallcultfollowing.com/babysteps/blog/2013/04/04/nes...

So, it happened somewhere in here...

Re: APT Rust requirement raises questions

#370
post #363

Earlier quoted context omitted.

Much of the drive to rewrite software in Rust is a reaction to the decades-long dependence on C and C++. Many people out there sit in the burning room like the dog in that meme, saying "this is fine". Most of them don't have to deal at all directly with the consequences involved. Rust is the first language for a long time with a chance at improving this situation. A lot of the pushback against evangelism is from peop…

If you were right, then people should not be using Rust or C/C++. They should be using SPARK/Ada. The SPARK programming language, a subset of Ada, was used for the development of safety-critical software in the Eurofighter Typhoon, a British and European fighter jet. The software for mission computers and other systems was developed by BAE Systems using the GNAT Pro environment from AdaCore, which supports both Ada a…

Nvidia evaluated Rust and then chose SPARK/Ada for root of trust for GPU market segmentation licensing, which protects 50% profit margin and $4T market cap.

"Nvidia Security Team: “What if we just stopped using C?”, 170 comments (2022), https://news.ycombinator.com/item?id=42998383

Post reply on HN