Live data from Hacker News

Rust is mostly safety

graydon2.dreamwidth.org

421–430 of 474 posts

Re: Rust is mostly safety

#421
post #20

The original Rust author make great points about safety. I think this new thrust on marketing emerges from Rust Roadmap 2017 which puts Rust usage in industry as one of the major goal. Currently Rust is about Go's age but nowhere close in usage. As the roadmap says "Production use measures our design success; it's the ultimate reality check." I agree with that.

> As the roadmap says "Production use measures our design success; it's the ultimate reality check." I agree with that. I don't. It's a measure of the overall success. Design is but a small part of that. Community, outreach, corporate back up… play a huge part in the success of a language. Go is a wonderful example: doesn't even provide parametric polymorphism (generics), and they got away with that! Feels like Googl…

> Go is a wonderful example: doesn't even provide parametric polymorphism (generics), and they got away with that!

Only because one can opt-out of the type system and use a catch all "interface {}" .Actually even the std lib does that ... a lot.

Re: Rust is mostly safety

#422
post #373

Earlier quoted context omitted.

> Memory safety is important for everything because it is a prerequisite for any other form of correctness. That's obviously true, but not what I (or the OP) was talking about. My point was that in many applications memory safety doesn't rank highly as a separate concern, in addition to computing correct output from expected input. Because of this, describing Rust as a language that solely focuses on memory safety is…

> My point was that in many applications memory safety doesn't rank highly as a separate concern, in addition to computing correct output from expected input Indeed, I was trying to cover that in my comment. I agree that it isn't an explicit selling point to such people, but I think that it should be: - numerics/scientific computing/machine learning are slowly taking over the world. It is bad to have random/occasiona…

Thanks for the insightful post. I stand corrected on the TCO issue, I had indeed misread the documentation, and I've posted a correction to my original post accordingly. The bounds checking issue is also resolved to my satisfaction.

> I'm not sure loop-based control flow is actually necessary, since (I believe) one can, say, parallelise over an enumerated iterator (e.g. slice.iter().enumerate()), which contains the indices. One can then .map() and read from the appropriate indices as required.

The loop-based control flow is, strictly speaking, never necessary, as the two formulations are mathematically equivalent. It's just that for many algorithms the loop-based approach is more intuitive (to many people) and readable, and has less boilerplate. Your simple_parallel library looks syntactically closer to what I'd like, though I'm not sure if it's still being maintained.

> To shortcut your search: https://doc.rust-lang.org/std/?search=fast . (I apologise that I didn't link it earlier, I was on a phone.)

Thanks. I'm glad the option is there, but the current implementation looks quite tedious to use in long numeric expressions, and would greatly sacrifice readability. Ideally, I'd like something along the lines of fastmath { } blocks or function / loop level annotations. Is something like that possible with Rust's metaprogramming, perhaps?

> - numerics/scientific computing/machine learning are slowly taking over the world. It is bad to have random/occasional heisenbugs in systems that influence decisions from the personal to the international.

That's theoretically true, but (in my opinion) practically irrelevant. The thing about numerical kernels is that input is constrained by the mathematics involved and the output is rigorously verifiable. In practice, I can't imagine a realistic case where a memory safety error would not be caught by the usual verification tests that any numeric code of any importance is routinely subject to. That's why programmers in this domain don't normally think about memory safety as a separate issue at all, it's just a small and not particularly remarkable part of the normal correctness testing. A guarantee of memory safety still doesn't free you from having to do all those tests anyway. Obviously, this is much different for systems software that takes inherently unpredictable user input that's difficult to sanitize.

> - games are very, very often touching the network these days, and thus are at risk of being exploited by a malicious attacker.

The argument here is, I think, much stronger than for numerical software. Nevertheless, even for online games (that are still only a subset of computer games), network data is comparatively easy to sanitize and memory safety issues wouldn't typically lead to exploitable attacks. I've never heard of a game used as a vector for a serious attack in any context, but at least it's somewhat conceivable in theory.

Re: Rust is mostly safety

#423

As someone looking at this influx of discussion from the point of view of a curious bystander, I can't help but be annoyed by two persistent misconceptions that keep being perpetuated in many statements of this kind. 1) Memory safety is or should be a top priority for all software everywhere. The OP goes so far as to state: "When someone says they "don't have safety problems" in C++, I am astonished: a statement that…

Apparently, the parent post is now too old to edit, so I'll post a correction here. In light of helpful input, I was wrong about the following:

1) Tail call optimizations are fine, the documentation is just a bit ambiguous on the matter.

2) Explicit vectorization is available in nightly.

3) The equivalent of -ffast-math is technically available, though very inconvenient to use. There may be workarounds, I'm not sure.

These points, coupled with the ability to do performant threading (in theory, even with the syntax I'd prefer), go a long way to alleviating some of my performance concerns. Well written (nightly) Rust may be closer to C++ in numerical performance than I initially thought. I'd like for some of these things to be much more convenient to use than they are currently, but the opportunities are there.

Re: Rust is mostly safety

#424
post #72

> Modula-3, Eiffel, Sather Nice to see these languages on Rust's team radar, specially Sather. Just shows how you guys have researched prior work, congratulations.

To be clear, Graydon doesn't work on Rust anymore, and hasn't in years. His knowledge of the space is absolutely impressive, though. :)

Yes, I've not seen a Napier reference in years. Really impressed to have seen that.

Re: Rust is mostly safety

#425
post #418
post #131

Earlier quoted context omitted.

What language you have in mind?

OCaml is my first thought in that space.

Ocaml is a good choice, and Anil Madhavapeddy used it for his unikernel ideas. But Ocaml doesn't have strong backing any more. JaneStreet alone isn't enough.

Re: Rust is mostly safety

#426
post #20

The original Rust author make great points about safety. I think this new thrust on marketing emerges from Rust Roadmap 2017 which puts Rust usage in industry as one of the major goal. Currently Rust is about Go's age but nowhere close in usage. As the roadmap says "Production use measures our design success; it's the ultimate reality check." I agree with that.

That's what I'm getting from the safe features emphasis and the fiercely C/C++ competitive slant argued by the evangelists in this thread.

I was looking through the pointer safety portion of the safety brochure: https://doc.rust-lang.org/book/unsafe.html#what-does-safe-me... and wondering how to approach unwrapping an ethernet packet on the wire in the easy unsigned pointer-specific way it can be done in C and came across a pcap implementation in Rust (sample source): https://github.com/ebfull/pcap/blob/master/src/raw.rs Are you serious? Rust is not for me, thanks.

Re: Rust is mostly safety

#427

What about stack overflows? I heard that rust no longer protects against those for benchmark reasons.

That's incorrect. On some platforms, stack probes are not yet implemented because the patch to LLVM hasn't been merged, and we need it to do this properly. Someone is working on getting that through right now.

What is "some platforms"? There is plenty of stuff in github that seems to indicate "only windows".

Re: Rust is mostly safety

#428
post #385

Earlier quoted context omitted.

If you know swift/objc pretty well with it's ARC reference counting memory management, do you pick up the borrow checker faster?

AFAIK Swift doesn't really have references or anything to enforce unique ownership. If you've ever used a language with pointers before, including the simple pointers that Go has, then that's a good start. If you further understand how escape analysis works in Go (or the various escaping annotations in Swift), then imagine a language where every variable must never escape, and where this is enforced by the compiler.…

Seeing that people keep testifying to the fact that the borrow cHecker gives them problems, I wouldn't say it's just a meme. Its easy and tempting to imagine problem points disappearing over time, but realistically, some portion of people will always run into it, because it's unique and fundamentally a bit complex. It's better to spread that message, that running into borrowing problems is a common, real, yet temporary hangup that can be overcome.

Re: Rust is mostly safety

#429
post #413

Earlier quoted context omitted.

I think it's especially hasty to criticize Rust's string types in the context of C++, given the standardization of string_view in C++ as an analogue of Rust's &str :P

To me, Rust's &str seems a lot more like const char* (with a size tacked on for bounds checking). But you're the expert, so if I did agree they were the same, then C++ adopting it in the STL is practically proof it's a mistake in Rust. You never addressed my other "too clever" items in Rust. Does that mean, other than strings, we agree?

> Does that mean, other than strings, we agree?

Not necessarily. :P Features exist, and I'm not about to dictate where others draw the cleverness line.

Re: Rust is mostly safety

#430

Earlier quoted context omitted.

> I think the safety aspect of Rust appeals to a lot of beginning programmers. Maybe, but it also appeals a lot to many of us experienced programmers who know how hard things can bite us. It's not so much that we can't get things right. It's that it's really expensive to revisit old assumptions when circumstances change, and it's phenomenal to be able to document more of these in a machine-checked way.

Please don't get me wrong - I would take safe over non-safe if everything else were equal. It's just that Rust made many other choices that are worse for me than what's in C++. Also, I think it would be very painful trying to explain some of Rust's features to my coworkers (who are generally very smart, but generally not interested in clever programming languages). > It's that it's really expensive to revisit old ass…

> That's very dependent on the type of work you do.

True, if your code never gets big or old, you can keep all of it in mind and write correct code without too much worry. Though in my experience, it really doesn't need to be very old or very big before tooling starts paying big dividends.

> I have medium sized libraries that I drag from project to project

I'd wonder in particular about those libraries. Certainly you know more about your context. But I expect that there are both contexts where it wouldn't be helpful, and also contexts where it would be substantially helpful but authors don't know what they're missing. I don't have a way of distinguishing the two here.

Post reply on HN