4 ms·
Even if the language pulled some magic trick where it could verify collection implementations without unsafe, all you'd have done is move the unsafety into the
by Rusky 11y ago
Even if the language pulled some magic trick where it could verify collection implementations without unsafe, all you'd have done is move the unsafety into the type checker and compiler backend.
The only difference is that Rust 1) moved some of that into the stdlib and 2) lets third parties extend it to provide more guarantees.
Given this, I think you're drawing a rather arbitrary line- Rust (the compiler + stdlib, optionally + other libraries wrapping unsafe) does guarantee memory safety, full stop. Whether the guarantees are provided by the stdlib or compiler is irrelevant.
- tomp 11y agoIt does guarantee memory safety... until you need to write your own collection. Then it explicitly endorses unsafe code (as opposed to offering a more powerful proof engine). I'm find with trusting something (compiler, proof engine, stdlib), but the issue is that safe Rust is barely a complete language!
- kibwen 11y agoThis is a strange argument. The `unsafe` keyword only lets you do the following: dereference unsafe pointers, call unsafe functions (which usually either dereference unsafe pointers themselves, or are just wrappers over C functions, which are obviously unprovable), and mutate static data. Saying that safe Rust is "barely complete" is just as good as saying that Python is "barely complete" due to the fact that it doesn't allow you to read arbitrary locations in memory.