5 ms·

Obviously, one can program C to do anything, and write all the provably safe abstractions wished. But, that's not really the point. The point is that doing such

Obviously, one can program C to do anything, and write all the provably safe abstractions wished. But, that's not really the point. The point is that doing such is not the default. It requires engagement and knowledge of the programmer, especially on distributed projects with loose communication, such as many open source projects. And it only takes one programmer mistake to bring the whole house of cards down. Why allow programmers to make mistakes? That was fine in the 70's when resources for compiler execution were limited. I don't see any reason for it today. I mean, just look at the underhanded C contestants and especially winners for ways in which your program can completely blow up for extremely subtle reasons.

panic 10y ago
And it only takes one programmer mistake to bring the whole house of cards down. Isn't this also true of Rust, with its unsafe keyword? None of these languages are completely safe against programmer mistakes.
- afarrell 10y ago
  Is the use of the unsafe keyword a default? I don't know Rust, but from a user interface perspective, it sounds like it has an affordance of "Hey! Pay particular attention to this bit because it is risky!"
  - steveklabnik 10y ago
    It is very much not the default.
  - Manishearth 10y ago
    It's more of a "Hey, trust me here when I say that the enclosed code is actually safe" hint to the compiler. It's used sparingly. Not as sparingly as I'd like, but sparingly enough.
    - afarrell 10y ago
      Sure, but code is not just instructions to a compiler, but is also a user interface.
      - Manishearth 10y ago
        Oh, yes, as a UI it is "be extremely wary of this code" Often folks write long comments around unsafe code explaining why it is safe. Not always, sadly.
- staticassertion 10y ago
  Totally. But in the case of rust your vulnerabilities are grep'able. For all of the code you have in a project you only have to search for the unsafe keyword when you want to audit it. I think that makes a very significant difference.
- sidlls 10y ago
  Yes. It's trivial in Rust to write unsafe code. It's less trivial to mask the unsafe code and the (unproven, in my opinion) argument is that the explicit "unsafe" keyword makes it prohibitively difficult.
- jdmichal 10y ago
  That's less of a mistake, and more of turning off the footgun's safety. Yes, it still only takes one programmer. But they have to purposefully enable such actions, as opposed to neglect to perform actions through the "proper" abstractions.
- jjnoakes 10y ago
  You are equating the unsafe keyword in Rust with entire C codebase. Yes, carelessness in either could amount to trouble. No, they are not close to the same amount of risk because the relative amount of code in each is orders of magnitude different, and unsafe blocks can be heavily reviewed.
- dbaupp 10y ago
  This is true of every language: e.g. Python has ctypes, Haskell has Foreign, Java has JNI, etc. It's a matter of defaults/conventions rather than something being literally impossible to screw up.
- mrsteveman1 10y ago
  > Isn't this also true of Rust, with its unsafe keyword? > None of these languages are completely safe No, but the first time I encountered an unexplained segfault in Rust was the first time I've ever found & fixed the cause of a weird segfault message in just a few minutes, because the mistake was in the 12 lines I had written inside a clearly marked unsafe block rather than the other ~3000. Without something like unsafe blocks, finding known bugs and auditing code for other "weird" memory issues means looking much wider (and often, screaming "what the hell are you talking about?!" at the screen on a routine basis).
- EugeneOZ 10y ago
  Even without `unsafe` programmer can make mistakes in Rust. Logical mistakes are unstoppable.
pjmlp 10y ago
Even in the 70's there were better alternatives outside AT&T walls, e.g. at Burroughs.
userbinator 10y ago
Why allow programmers to make mistakes? For a philosophical counterpoint: Why allow anyone to do anything that might possibly be incorrect, harmful, or otherwise perceived by some to be negative? I've looked at a lot of the talk surrounding "safe/secure languages", "safe/secure programming", etc., and yet every time I've heard people preach about the benefits, I feel like I just vehemently disagree. At a very deep and fundamental level, I feel like somehow we are sacrificing something more important in the pursuit of this "safety", this seemingly overpowering desire to make everything completely safe, mindlessly constricted, and stifling. It's not just software; the whole "war on terrorism" irks me in the same way. I imagine a "completely safe" world, the ones these "safe software" proponents appear to be striving for, would be rather dystopian. A quote that immediately comes to mind is: "Freedom is not worth having if it does not include the freedom to make mistakes."
- burntsushi 10y ago
  That's a great quote, and it's one that Rust---as a a memory safe language---completely embraces. You have the freedom to do anything you want. Some of those things simply require you to type "unsafe."
  - pekk 10y ago
    Forgive me for being cheeky, but just as Rust requires you to type "unsafe," C also requires you to opt in by typing "cc". My serious point is that in practice, the example of C shows that if it is available and people understand that it is "performant" then you will see it all the time, including in libraries you are forced to use.
    - burntsushi 10y ago
      > Forgive me for being cheeky, but just as Rust requires you to type "unsafe," C also requires you to opt in by typing "cc". This isn't an accurate analogy at all because I can compile thousands of lines of Rust code without even thinking about needing to use `unsafe`. How many lines of C code can you compile without `cc`? > My serious point is that in practice, the example of C shows that if it is available and people understand that it is "performant" then you will see it all the time, including in libraries you are forced to use. Except this is already demonstrably false in the Rust ecosystem.

panic 10y ago

And it only takes one programmer mistake to bring the whole house of cards down. Isn't this also true of Rust, with its unsafe keyword? None of these languages are completely safe against programmer mistakes.

afarrell 10y ago
Is the use of the unsafe keyword a default? I don't know Rust, but from a user interface perspective, it sounds like it has an affordance of "Hey! Pay particular attention to this bit because it is risky!"
- steveklabnik 10y ago
  It is very much not the default.
- Manishearth 10y ago
  It's more of a "Hey, trust me here when I say that the enclosed code is actually safe" hint to the compiler. It's used sparingly. Not as sparingly as I'd like, but sparingly enough.
  - afarrell 10y ago
    Sure, but code is not just instructions to a compiler, but is also a user interface.
    - Manishearth 10y ago
      Oh, yes, as a UI it is "be extremely wary of this code" Often folks write long comments around unsafe code explaining why it is safe. Not always, sadly.
staticassertion 10y ago
Totally. But in the case of rust your vulnerabilities are grep'able. For all of the code you have in a project you only have to search for the unsafe keyword when you want to audit it. I think that makes a very significant difference.
sidlls 10y ago
Yes. It's trivial in Rust to write unsafe code. It's less trivial to mask the unsafe code and the (unproven, in my opinion) argument is that the explicit "unsafe" keyword makes it prohibitively difficult.
jdmichal 10y ago
That's less of a mistake, and more of turning off the footgun's safety. Yes, it still only takes one programmer. But they have to purposefully enable such actions, as opposed to neglect to perform actions through the "proper" abstractions.
jjnoakes 10y ago
You are equating the unsafe keyword in Rust with entire C codebase. Yes, carelessness in either could amount to trouble. No, they are not close to the same amount of risk because the relative amount of code in each is orders of magnitude different, and unsafe blocks can be heavily reviewed.
dbaupp 10y ago
This is true of every language: e.g. Python has ctypes, Haskell has Foreign, Java has JNI, etc. It's a matter of defaults/conventions rather than something being literally impossible to screw up.
mrsteveman1 10y ago
> Isn't this also true of Rust, with its unsafe keyword? > None of these languages are completely safe No, but the first time I encountered an unexplained segfault in Rust was the first time I've ever found & fixed the cause of a weird segfault message in just a few minutes, because the mistake was in the 12 lines I had written inside a clearly marked unsafe block rather than the other ~3000. Without something like unsafe blocks, finding known bugs and auditing code for other "weird" memory issues means looking much wider (and often, screaming "what the hell are you talking about?!" at the screen on a routine basis).
EugeneOZ 10y ago
Even without `unsafe` programmer can make mistakes in Rust. Logical mistakes are unstoppable.

pjmlp 10y ago

Even in the 70's there were better alternatives outside AT&T walls, e.g. at Burroughs.

userbinator 10y ago

Why allow programmers to make mistakes? For a philosophical counterpoint: Why allow anyone to do anything that might possibly be incorrect, harmful, or otherwise perceived by some to be negative? I've looked at a lot of the talk surrounding "safe/secure languages", "safe/secure programming", etc., and yet every time I've heard people preach about the benefits, I feel like I just vehemently disagree. At a very deep and fundamental level, I feel like somehow we are sacrificing something more important in the pursuit of this "safety", this seemingly overpowering desire to make everything completely safe, mindlessly constricted, and stifling. It's not just software; the whole "war on terrorism" irks me in the same way. I imagine a "completely safe" world, the ones these "safe software" proponents appear to be striving for, would be rather dystopian. A quote that immediately comes to mind is: "Freedom is not worth having if it does not include the freedom to make mistakes."

burntsushi 10y ago
That's a great quote, and it's one that Rust---as a a memory safe language---completely embraces. You have the freedom to do anything you want. Some of those things simply require you to type "unsafe."
- pekk 10y ago
  Forgive me for being cheeky, but just as Rust requires you to type "unsafe," C also requires you to opt in by typing "cc". My serious point is that in practice, the example of C shows that if it is available and people understand that it is "performant" then you will see it all the time, including in libraries you are forced to use.
  - burntsushi 10y ago
    > Forgive me for being cheeky, but just as Rust requires you to type "unsafe," C also requires you to opt in by typing "cc". This isn't an accurate analogy at all because I can compile thousands of lines of Rust code without even thinking about needing to use `unsafe`. How many lines of C code can you compile without `cc`? > My serious point is that in practice, the example of C shows that if it is available and people understand that it is "performant" then you will see it all the time, including in libraries you are forced to use. Except this is already demonstrably false in the Rust ecosystem.