10 ms·

It's nice to see a balanced, real world, case study including 'these things are fixed by Rust', 'these are problems that don't occur in idiomatic Rust', and 'th

It's nice to see a balanced, real world, case study including 'these things are fixed by Rust', 'these are problems that don't occur in idiomatic Rust', and 'these are problems that Rust can't help you with'. I'm a big fan of Rust, but the one sided 'Rust makes all the problems go away' articles don't provide any value.

tspiteri 8y ago
It also highlights an example of a security bug introduced during rewriting; highlighting that rewriting any significantly large piece of software is bound to introduce bugs.
- dmix 8y ago
  Not just introducing new bugs but reintroducing old bugs which were publicly documented and/or previously exploited. Which you could argue are worse as it’s a lower barrier for detection by attackers, but also on the otherhand by the team/community. Also of note was that there was already an automated test for one of the high priority bugs that got reintroduced but the that particular tests was turned off.
  - eridius 8y ago
    What confuses me about this is the tests were turned off because they were taking too long. But wouldn't the appropriate behavior there be "run a subset of the tests normally, but run the full test suite occasionally" rather than just disabling the tests completely?
    - dmix 8y ago
      Or turn off some during development but run the whole suite before release? I have a feeling the a bunch of the tests in that particular category needed to be updated, so it wasn't simply just too long.
      - indolering 8y ago
        Pretty clear that the QA process is at fault here, which is sadly common in the software industry.
duxup 8y ago
Yeah I keep hearing / reading about rust, even seen some demos but the demos all end with "oh no I'm not using this for anything". Still cool but ... want to see someone doing something in production / get their thoughts on that. Edit: To be clear I'm not saying anyone isn't using it, this is just more of a comment about the impression I can get when I hear about X tech is so cool, but that's most of what I hear and at some point I want to see those same articles about real world use / experiences. I'm aware Mozilla and others are using it.
- chillydawg 8y ago
  Firefox?
  - duxup 8y ago
    I'm not saying nobody is using it, just the volume of "hey this is so cool" gets to be a bit much and I want to see more "here it is solving problems in production for a real thing".
    - kbenson 8y ago
      The explorations and small little demos and projects in a language is almost always higher than the number of production uses, it's just that in popular languages nobody cares to read much about it (or at least share is so it spreads), because it's already known. Rust is still fairly uncommon, so you're bound to see a lot of people announcing their experiences while playing around with it, and that can skew the perceived ratio of things. I think the problem is solved by paying less attention to the stuff you care about less, and/or seeking out more production(y) uses if desired by looking in places where it's already common, such as /r/rust, where the content ratio will naturally fall more favorably towards production uses, libraries and advanced discussions since a minimum level of experience (or at least interest) can be assumed.
- rapsey 8y ago
  We're doing a low level core functionality lib in Rust that is shared between Windows desktop, iOS and Android apps. It works really well. If we were to do it again, the core Rust lib would do much more and the platform native code would only be things that need to be like UI and notifications.
millstone 8y ago
These are all ways that Rust is neutral or better. Were there any ways that Rust was worse? For example, did the previous code use value-type templates? If so how was their absence worked around in the new code?
- Thaxll 8y ago
  Chucklefish made some buzz few month ago saying they were writting there new game in Rust, they now stopped and went back to C++. https://www.reddit.com/r/programming/comments/atyzz4/halley_a_lightweight_game_engine_written_in_c14/eh69lz7/ https://www.reddit.com/r/programming/comments/atyzz4/halley_...
  - steveklabnik 8y ago
    They're still using Rust for some stuff, just not for the game itself. Wargroove's matchmaking server is still in Rust. That said, yes, this is a good example of what your parent is asking for. https://www.reddit.com/r/programming/comments/atyzz4/halley_a_lightweight_game_engine_written_in_c14/eh5kdqv/ https://www.reddit.com/r/programming/comments/atyzz4/halley_... has some more context too
    - steveklabnik 8y ago
      Even more context: https://www.reddit.com/r/rust/comments/avwxq1/comment/ehijdwx https://www.reddit.com/r/rust/comments/avwxq1/comment/ehijdw...
- pum-purum 8y ago
  Compile time. For my 9k lines project it takes 20 sec to compile in debug mode and 1 minute in release. Wich is insane because I have to do a lot of runs to test things(where cargo check can't help).
  - pum-purum 8y ago
    In spite of this i'm in love with Rust
hedora 8y ago
Overall, it did a decent job of being balanced, but I don’t buy the memory overflow example at all. For one thing, idiomatic C++ bounds checks by default. You need to use at(). If you don’t like typing at(), you can implement an array type that always bounds checks fairly easily. On that note, the vulnerable c++ code should be using accessors, not indexing to access the oddly packed and laid out array. Even the fixed version wouldn’t pass a code review from me. You could write equivalently bad code in any language that supports array types, and get similarly broken results. For another thing, there’s no evidence that you couldn’t achieve the same improved data structures in C++ using its type system (which is turing complete...) The “thread safe by default” property sounds interesting; I’d be interested in reading more about that.
- masklinn 8y ago
  > For one thing, idiomatic C++ bounds checks by default. You need to use at(). Sounds like it doesn't check by default then. It checks if you remember to check using the more verbose bounds-checking method. Not unlike the issues with subscripting std::map.
  - jgon 8y ago
    This is like saying the Rust doesn't have memory safety because you can use "unsafe". C++ offers you a safe Api and an unsafe API if you want to go that way. If you decide to use the unsafe api the consequences are on you, the same way that it is on you if you decide to use "unsafe" in Rust.
    - steveklabnik 8y ago
      The difference is in the defaults. In Rust, the easiest and more common thing ([]) is checked, and the more verbose and uncommon thing (get_unchecked) is unchecked. In C++, it's the reverse.
    - masklinn 8y ago
      > This is like saying the Rust doesn't have memory safety because you can use "unsafe". It's the exact opposite which is the point. Rust requires extra work and using the non-default and less convenient way for unsafety, C++ requires extra work and using the non-default method and less convenient way for safety.

tspiteri 8y ago

It also highlights an example of a security bug introduced during rewriting; highlighting that rewriting any significantly large piece of software is bound to introduce bugs.

dmix 8y ago
Not just introducing new bugs but reintroducing old bugs which were publicly documented and/or previously exploited. Which you could argue are worse as it’s a lower barrier for detection by attackers, but also on the otherhand by the team/community. Also of note was that there was already an automated test for one of the high priority bugs that got reintroduced but the that particular tests was turned off.
- eridius 8y ago
  What confuses me about this is the tests were turned off because they were taking too long. But wouldn't the appropriate behavior there be "run a subset of the tests normally, but run the full test suite occasionally" rather than just disabling the tests completely?
  - dmix 8y ago
    Or turn off some during development but run the whole suite before release? I have a feeling the a bunch of the tests in that particular category needed to be updated, so it wasn't simply just too long.
    - indolering 8y ago
      Pretty clear that the QA process is at fault here, which is sadly common in the software industry.

duxup 8y ago

Yeah I keep hearing / reading about rust, even seen some demos but the demos all end with "oh no I'm not using this for anything". Still cool but ... want to see someone doing something in production / get their thoughts on that. Edit: To be clear I'm not saying anyone isn't using it, this is just more of a comment about the impression I can get when I hear about X tech is so cool, but that's most of what I hear and at some point I want to see those same articles about real world use / experiences. I'm aware Mozilla and others are using it.

chillydawg 8y ago
Firefox?
- duxup 8y ago
  I'm not saying nobody is using it, just the volume of "hey this is so cool" gets to be a bit much and I want to see more "here it is solving problems in production for a real thing".
  - kbenson 8y ago
    The explorations and small little demos and projects in a language is almost always higher than the number of production uses, it's just that in popular languages nobody cares to read much about it (or at least share is so it spreads), because it's already known. Rust is still fairly uncommon, so you're bound to see a lot of people announcing their experiences while playing around with it, and that can skew the perceived ratio of things. I think the problem is solved by paying less attention to the stuff you care about less, and/or seeking out more production(y) uses if desired by looking in places where it's already common, such as /r/rust, where the content ratio will naturally fall more favorably towards production uses, libraries and advanced discussions since a minimum level of experience (or at least interest) can be assumed.
rapsey 8y ago
We're doing a low level core functionality lib in Rust that is shared between Windows desktop, iOS and Android apps. It works really well. If we were to do it again, the core Rust lib would do much more and the platform native code would only be things that need to be like UI and notifications.

millstone 8y ago

These are all ways that Rust is neutral or better. Were there any ways that Rust was worse? For example, did the previous code use value-type templates? If so how was their absence worked around in the new code?

Thaxll 8y ago
Chucklefish made some buzz few month ago saying they were writting there new game in Rust, they now stopped and went back to C++. https://www.reddit.com/r/programming/comments/atyzz4/halley_a_lightweight_game_engine_written_in_c14/eh69lz7/ https://www.reddit.com/r/programming/comments/atyzz4/halley_...
- steveklabnik 8y ago
  They're still using Rust for some stuff, just not for the game itself. Wargroove's matchmaking server is still in Rust. That said, yes, this is a good example of what your parent is asking for. https://www.reddit.com/r/programming/comments/atyzz4/halley_a_lightweight_game_engine_written_in_c14/eh5kdqv/ https://www.reddit.com/r/programming/comments/atyzz4/halley_... has some more context too
  - steveklabnik 8y ago
    Even more context: https://www.reddit.com/r/rust/comments/avwxq1/comment/ehijdwx https://www.reddit.com/r/rust/comments/avwxq1/comment/ehijdw...
pum-purum 8y ago
Compile time. For my 9k lines project it takes 20 sec to compile in debug mode and 1 minute in release. Wich is insane because I have to do a lot of runs to test things(where cargo check can't help).
- pum-purum 8y ago
  In spite of this i'm in love with Rust

hedora 8y ago

Overall, it did a decent job of being balanced, but I don’t buy the memory overflow example at all. For one thing, idiomatic C++ bounds checks by default. You need to use at(). If you don’t like typing at(), you can implement an array type that always bounds checks fairly easily. On that note, the vulnerable c++ code should be using accessors, not indexing to access the oddly packed and laid out array. Even the fixed version wouldn’t pass a code review from me. You could write equivalently bad code in any language that supports array types, and get similarly broken results. For another thing, there’s no evidence that you couldn’t achieve the same improved data structures in C++ using its type system (which is turing complete...) The “thread safe by default” property sounds interesting; I’d be interested in reading more about that.

masklinn 8y ago
> For one thing, idiomatic C++ bounds checks by default. You need to use at(). Sounds like it doesn't check by default then. It checks if you remember to check using the more verbose bounds-checking method. Not unlike the issues with subscripting std::map.
- jgon 8y ago
  This is like saying the Rust doesn't have memory safety because you can use "unsafe". C++ offers you a safe Api and an unsafe API if you want to go that way. If you decide to use the unsafe api the consequences are on you, the same way that it is on you if you decide to use "unsafe" in Rust.
  - steveklabnik 8y ago
    The difference is in the defaults. In Rust, the easiest and more common thing ([]) is checked, and the more verbose and uncommon thing (get_unchecked) is unchecked. In C++, it's the reverse.
  - masklinn 8y ago
    > This is like saying the Rust doesn't have memory safety because you can use "unsafe". It's the exact opposite which is the point. Rust requires extra work and using the non-default and less convenient way for unsafety, C++ requires extra work and using the non-default method and less convenient way for safety.