4 ms·

> Python with Rust as its foundation sounds like the best idea ever. Why do you think it's the "best idea ever"? What are the benefits over any other Python im

by grok2 8y ago

> Python with Rust as its foundation sounds like the best idea ever. Why do you think it's the "best idea ever"? What are the benefits over any other Python implementation?

nickpsecurity 8y ago
Python has massive use in a diverse array of fields with lots of educational resources helping beginners. There is and will be for a while lots of Python code. It's increasingly used in business-critical systems, like at Bank of America. That it's built on an unsafe language puts that all at risk of unreliability and security vulnerabilities. Long ago, I wanted to rewrite it in Ada with all safety features on to mitigate that risk while maintaining its convenience. Rust is another safe, systems language with extra measures for temporal errors. So, this project is doing the same thing. Full security for Python apps would require consideration of each layer of abstraction: 1. User's code in Python. 2. The interpreter and extensions. 3. How these interact. 4. If added for performance or security, any assembly code plus its interactions. Rewriting Python interpreter in Rust mainly addresses No 2. An example of a method to address all of them would be Abstract, State Machines which can represent simultaneously language semantics, software, and hardware. Tools like Asmeta exist to make them like programming languages. The verification would probably be manual, specialist work. Whereas, Rust's compiler gives you key properties with just annotations for many and working with borrow-checker for a few.
- deleted 8y ago
  [deleted]
- dnautics 8y ago
  > That it's built on an unsafe language puts that all at risk of unreliability and security vulnerabilities Has this actually been a problem, though? I'm no lover of python, but tons of people seem to use, for example, Django, without incident.
  - sametmax 8y ago
    Now but you need an incredible high level of mastery to work on such a big C project so widely deployed. Rust will allow to safely invite a broader range of contributors, because there are so many things you don't need to check. This also means a smaller number of required tests, and because Rust uses higher level constructs that C, more productivity in general. So basically, on the long run, more people, able to do more things. Besides, on of the goals of the main implementation is to stay simple, which is hard to do in C. For those reasons, and because of the potential for unreliability and security, CPython is quite slow. We can't optimize it, because it would make it too complex. But with a rust implementation, one can hope to suddenly be able to apply more optimizations. It's all theorical of course, but it's a nice hope.

by grok2 8y ago

> Python with Rust as its foundation sounds like the best idea ever. Why do you think it's the "best idea ever"? What are the benefits over any other Python implementation?

nickpsecurity 8y ago

Python has massive use in a diverse array of fields with lots of educational resources helping beginners. There is and will be for a while lots of Python code. It's increasingly used in business-critical systems, like at Bank of America. That it's built on an unsafe language puts that all at risk of unreliability and security vulnerabilities. Long ago, I wanted to rewrite it in Ada with all safety features on to mitigate that risk while maintaining its convenience. Rust is another safe, systems language with extra measures for temporal errors. So, this project is doing the same thing. Full security for Python apps would require consideration of each layer of abstraction: 1. User's code in Python. 2. The interpreter and extensions. 3. How these interact. 4. If added for performance or security, any assembly code plus its interactions. Rewriting Python interpreter in Rust mainly addresses No 2. An example of a method to address all of them would be Abstract, State Machines which can represent simultaneously language semantics, software, and hardware. Tools like Asmeta exist to make them like programming languages. The verification would probably be manual, specialist work. Whereas, Rust's compiler gives you key properties with just annotations for many and working with borrow-checker for a few.

deleted 8y ago
[deleted]
dnautics 8y ago
> That it's built on an unsafe language puts that all at risk of unreliability and security vulnerabilities Has this actually been a problem, though? I'm no lover of python, but tons of people seem to use, for example, Django, without incident.
- sametmax 8y ago
  Now but you need an incredible high level of mastery to work on such a big C project so widely deployed. Rust will allow to safely invite a broader range of contributors, because there are so many things you don't need to check. This also means a smaller number of required tests, and because Rust uses higher level constructs that C, more productivity in general. So basically, on the long run, more people, able to do more things. Besides, on of the goals of the main implementation is to stay simple, which is hard to do in C. For those reasons, and because of the potential for unreliability and security, CPython is quite slow. We can't optimize it, because it would make it too complex. But with a rust implementation, one can hope to suddenly be able to apply more optimizations. It's all theorical of course, but it's a nice hope.