6 ms·

Since any Rust function may use unsafe code, you don't know whether bets are off for any particular function call.

kibwen 8y ago
Any public API using `unsafe` code that can't enforce its own unsafe invariants should (and in practice does) get marked as `unsafe` itself in order to force callers to use `unsafe` when calling that function. Of course it's something that, by definition, the compiler cannot enforce on its own and hence requires social norms and social pressure to enforce, and it's therefore fortunate that the Rust community takes it very seriously.
Retra 8y ago
Yeah, in theory. In practice, if someone writes code that is throwing away compiler checks for no reason, you simply don't use it.
paulddraper 8y ago
But very many pieces of code, even such pedestrian things as data structures require unsafe code. So the attitude of "only unsafe programs have UB by the Rust spec" effectively means "all programs have UB by the Rust spec"
dbaupp 8y ago
Any Python function may use ctypes, any Haskell function may use unsafePerformIO, ..., so all bets are off all the time. I don't think that's a particularly useful point, as is.
- lomnakkus 8y ago
  Not that this "makes the point", necessarily, but GHC Haskell does have the whole Safe/Unsafe Haskell module inference/guarantee, so it may be a bit easier to avoid unexpectedly unsafe behavior entirely. I have no idea whether any equivalent exists for Rust.
  - steveklabnik 8y ago
    Rust requires you to to explicitly mark individual blocks of code as unsafe, and you can only do unsafe operations inside of them.
    - deleted 8y ago
      [deleted]
  - dbaupp 8y ago
    There's not a module-level Safe/Trustworthy/Unsafe division, but as steveklabnik1 says, any potentially-dangerous code has to be placed into an `unsafe` block. One can also forbid the use of any `unsafe` blocks for a crate/module (with the #[forbid(unsafe_code)] attribute), but this is slightly different to the {-# LANGUAGE Safe #-} pragma in that it does consider imports at all. However, since "unsafety" is modeled in the language in Rust, and is granular, people are encouraged to have every module be "Trustworthy" (in Safe Haskell terms): if an individual function could cause undefined behaviour if misused, it should be marked "unsafe", and a "Safe" module (i.e. one using the forbid above) won't be able to use it.

Any public API using `unsafe` code that can't enforce its own unsafe invariants should (and in practice does) get marked as `unsafe` itself in order to force callers to use `unsafe` when calling that function. Of course it's something that, by definition, the compiler cannot enforce on its own and hence requires social norms and social pressure to enforce, and it's therefore fortunate that the Rust community takes it very seriously.

Retra 8y ago

Yeah, in theory. In practice, if someone writes code that is throwing away compiler checks for no reason, you simply don't use it.

paulddraper 8y ago

But very many pieces of code, even such pedestrian things as data structures require unsafe code. So the attitude of "only unsafe programs have UB by the Rust spec" effectively means "all programs have UB by the Rust spec"

dbaupp 8y ago

Any Python function may use ctypes, any Haskell function may use unsafePerformIO, ..., so all bets are off all the time. I don't think that's a particularly useful point, as is.

lomnakkus 8y ago
Not that this "makes the point", necessarily, but GHC Haskell does have the whole Safe/Unsafe Haskell module inference/guarantee, so it may be a bit easier to avoid unexpectedly unsafe behavior entirely. I have no idea whether any equivalent exists for Rust.
- steveklabnik 8y ago
  Rust requires you to to explicitly mark individual blocks of code as unsafe, and you can only do unsafe operations inside of them.
  - deleted 8y ago
    [deleted]
- dbaupp 8y ago
  There's not a module-level Safe/Trustworthy/Unsafe division, but as steveklabnik1 says, any potentially-dangerous code has to be placed into an `unsafe` block. One can also forbid the use of any `unsafe` blocks for a crate/module (with the #[forbid(unsafe_code)] attribute), but this is slightly different to the {-# LANGUAGE Safe #-} pragma in that it does consider imports at all. However, since "unsafety" is modeled in the language in Rust, and is granular, people are encouraged to have every module be "Trustworthy" (in Safe Haskell terms): if an individual function could cause undefined behaviour if misused, it should be marked "unsafe", and a "Safe" module (i.e. one using the forbid above) won't be able to use it.