Live data from Hacker News

Open-source Zig book

zigbook.net

371–380 of 426 posts

Re: Open-source Zig book

#371
post #344

Earlier quoted context omitted.

> And while I don't have enough experience with Rust to claim this first hand, my understanding is that writing correct unsafe Rust code is at least an order of magnitude harder than writing correct Zig code due to all of the properties/invariants that you have to preserve. How do you make such boldly dismissive assertions if you don't have enough experience with Rust? You are talking as if these invariants are some…

> How do you make such boldly dismissive assertions As I said that's my understanding from talking and listening to people who have a lot of experience with Rust, Zig, and C. So generally speaking, are you saying that writing correct unsafe Rust is only as difficult as writing correct Zig code and not, as I understand it to be, significantly more difficult?

> So generally speaking, are you saying that writing correct unsafe Rust is only as difficult as writing correct Zig code and not, as I understand it to be, significantly more difficult?

Yes. That's correct. The point is, unsafe Rust is pretty unremarkable. Safe Rust doesn't just do borrow checking of references. It also forbids certain risky actions like raw pointer indirection or calling unsafe functions (across FFI, for example) [1]. Unsafe Rust just enables those features. That's it! Unsafe Rust doesn't disable anything or impose any additional restrictions. Contrary to a popular misconception, it doesn't even disable the borrow checker. Unsafe Rust actually gives you extra freedoms on top of what you already have (including the restrictions).

And now you have to be careful because Rust just gave you a footgun that you asked for. In a manually memory-managed language, you'd get fatigued by the constant worry about this footgun. In Rust, that worry is limited to those unsafe blocks, giving you the luxury to workout strategies to avoid shooting yourself in the foot. The 'invariants' are that strategy. You describe the conditions under which the code is valid. Then you enforce it there, so that you can breath freely in Safe Rust.

[1] https://doc.rust-lang.org/nomicon/what-unsafe-does.html#what...

Re: Open-source Zig book

#372
post #196
post #161

Earlier quoted context omitted.

That statement is honestly self-contradictory. If a draft was AI-generated and then reviewed, edited, and owned by a human contributor, then the parts which survived reviewing and editing verbatim were still AI-generated...

Why do you care, if a human reviewed and edited it, someone filtered it to make sure it’s correct. It’s validated to be correct, that is the main point.

Clearly someone didn't make sure everything is correct, since they allowed a self-contradictory statement (whether generated by AI or by human) into the text...

Re: Open-source Zig book

#373

Earlier quoted context omitted.

Why are we comparing a number of exploitable vulnerabilities to the number of segfault reports? Where does the "5000x" figure come from?

The number is memory vulnerabilities. Not if they are exploitable. The numbers comes from this part of the article: This near-miss inevitably raises the question: "If Rust can have memory safety vulnerabilities, then what’s the point?" The point is that the density is drastically lower. So much lower that it represents a major shift in security posture. Based on our near-miss, we can make a conservative estimate. Wit…

Then someone's playing with definitions here because a bug that can't be exploited and doesn't have a demonstrable impact on safety or security isn't a vulnerability under any definition that I subscribe to - it's just a bug.

What we ultimately care about is how many preventable, serious defects sneak into production code - particularly those concerning data security, integrity, and physical safety. The only statistics we should all care about is how many serious CVEs end up in the final product, everything else is just personal preference.

Eliminating a segfault when `--help` is provided twice is nice, but it didn't fix a security vulnerability so using it to bolster the security argument is dishonest.

Re: Open-source Zig book

#374
post #344

Earlier quoted context omitted.

> And while I don't have enough experience with Rust to claim this first hand, my understanding is that writing correct unsafe Rust code is at least an order of magnitude harder than writing correct Zig code due to all of the properties/invariants that you have to preserve. How do you make such boldly dismissive assertions if you don't have enough experience with Rust? You are talking as if these invariants are some…

> How do you make such boldly dismissive assertions As I said that's my understanding from talking and listening to people who have a lot of experience with Rust, Zig, and C. So generally speaking, are you saying that writing correct unsafe Rust is only as difficult as writing correct Zig code and not, as I understand it to be, significantly more difficult?

If no references are involved, writing unsafe Rust is significantly easier than writing correct C, because the semantics are much clearer and easier to find in the documentation, and there's no insane things like type-based aliasing rules.

If references are involved, Rust becomes harder, because the precise semantics are not decided or documented. The semantics aren't complicated; they're along the lines of "while a reference is live, you can't perform a conflicting access from a pointer or reference not derived from that reference". But there aren't good resources for learning this or clarifying the precise details. This area is an active work-in-progress; there is a subteam of the Rust project led by Ralf Jung (https://www.ralfj.de/blog/) working on fully and clearly defining the language's operational semantics, and they are doing an excellent job of it.

When it comes to Zig, the precise rules and semantics of the memory model are much less clear than C. There's essentially no documentation, and if you search GitHub issues a lot of it is undecided and not actively being worked on. This is completely understandable given Zig's stage in development, but for me "how easy it is to write UB-free code" boils down to "how easy is it to understand the rules and apply them correctly", and so to me Zig is very hard to write correctly if you can't even figure out what "correct" is.

Once Zig and Rust both have their memory models fleshed out, I hope Zig lands somewhere comparable to where Rust-without-references is today, and I hope that Rust-with-references ends up being only a little bit harder (and still easier than C).

Re: Open-source Zig book

#375
post #342
post #311

Earlier quoted context omitted.

> Rust is not designed for low level system programming / embedded systems like Zig is. Pray tell, with Rust already being used in kernels, drivers, and embedded what makes Zig better suited for low-level systems? More chance to explode a UB in your hand? For that, there is C.

Great C interop, first class support for cross-compilation, well suited for arena allocators. You can use Rust in kernel/embedded code, you can also use C++ (I did) and even Java! but most prefer to use C, and I think that Zig is a better alternative to C for those in the field. There is still one huge drawback with Zig and that's maturity. Zig is still in beta, and the closest you get to the metal, the more it tends…

> Great C interop, first class support for cross-compilation, well suited for arena allocators.

C interop and arena allocators aren't hard requirements for a kernel language. In fact, why would a kernel in need to talk to C? You need it to talk to Assembly/Machine code, not C.

It helps if it can talk to/from C but it's not a requirement.

> customers heard about Rust as some magical tech that will make the code bug-free

That's on customers not having a clear picture. What we can look at experimentally is that yes, Rust will remove a whole suite of bugs, and no, Zig won't help there. Is Zig better than C? Sure, but so is C++ and it still sucks at it.

Like, the few big things wrong with Rust is probably compilation speed and async needing more tweaks (pinned places ergonomics, linear types to deal with async drop...) to make it way better.

Re: Open-source Zig book

#376
post #324
post #314

Earlier quoted context omitted.

That kind of is a bit load bearing. The differences are pretty huge. Plus, borrow checker is nowhere to be found. Cyclone is more C with a few tweaks (tagged unions, generics, regions, etc.).

Borrow checking is basically a synonym for affine type system. The same outcome can be achieved via affine types, linear types, effects, dependent types, regions, proofs, among many other CS research in type systems. Which is why following Rust's success, plenty of managed languages are now going through the evolution step to combine automatic resource management with improved type systems. Taking the one that best a…

> Borrow checking is basically a synonym for affine type system.

No? It's more akin to flow analysis with special generic types called lifetimes.

> The same outcome can be achieved via affine types, linear types, effects, dependent types, regions, proofs, among many other CS research in type systems.

Sure, and sounds, colors, and instruments are the same, but they are mixed to create an audio-video song. I'm not saying that what Rust did is something that came about ex nihilo, without precedence.

But having it all unified uniquely the way Rust did it is frankly revolutionary. Until now, people assumed if you want memory safety, you have to add a GC (tracing or RC). Or alternatively write extensive proofs about types like Ada/Spark.

Re: Open-source Zig book

#378

Earlier quoted context omitted.

D has similar comptime capabilities if I recall correctly and proceeds Zig by almost 2 decades or so.

I don't think it's the same. You can do template metaprogramming, but Zig lets you use Zig itself which is a lot nicer. I'm not a D programmer though so I could be wrong.

I’m not a D programmer but I remember talks by Alexandrescu where he was arguing for this capability in C++ and ultimately one of his stated reasons why he switched from C++ to D

Look up static if - AST manipulation in native D code.

Re: Open-source Zig book

#379
post #350

The biggest red flag for me is the author hiding their name. If you wrote quality book about a programming language you are not hiding your identity from the world.

The repository also has a misconfigured .gitignore file which allowed them to check in some built executables into the repository.

This is something that I wouldn't judge beginners for, but someone claiming to be an expert writing a book on the topic should know how to configure a .gitignore for their particular language of expertise.

Re: Open-source Zig book

#380

Earlier quoted context omitted.

That’s fine. Write it out yourself and then ask an AI how it could be improved with a diff. Now you’ve given it double human review (once in creation then again reviewing the diff) and single AI review.

That's one review with several steps and some AI assistance. Checking your work twice is not equivalent to it having it reviewed by two people, part of reviewing your work (or the work of others) is checking multiple times and taking advantage of whatever tools are at your disposal.

The point was to bookend your human review around automated. Not stamp out a blueprint.
Post reply on HN