4 ms·

The main thing going for it is that it's not Ada. Most C and C++ developers don't want to use Ada. Some of them are adopting Rust. It also has a strong communit

The main thing going for it is that it's not Ada. Most C and C++ developers don't want to use Ada. Some of them are adopting Rust. It also has a strong community and ecosystem. That was its key advantage. Finally, it has temporal safety that Ada doesn't with its borrow checker. What Ada has on it are its IDE's, MDD, and testing tools that industry is currently using. With stuff like RV-Match and Astree Analyzer, MISRA-C is probably safer than Rust. Rust needs more tooling to be competitive.

carlmr 7y ago
Normal rust without warnings to me is much safer than most Misra C compliant code. Misra C is an attempt to avoid 80% of C's undefined behavior and other pitfalls, but those 20% that are left are still worse than most of what can go wrong in rust. The problem is mostly certification and having a stable spec for the language.
carlmr 7y ago
Normal rust without warnings to me is much safer than most Misra C compliant code. Misra C is an attempt to avoid 80% of C's undefined behavior and other pitfalls, but those 20% that are left are still worse than most of what can go wrong in rust. The tooling that is needed is mostly productivity tooling, like better code completion (rust analyzer is now pretty promising after RLS kind of stagnated). And maybe better ways to show code coverage. The problem for usage in safety critical areas is mostly certification and having a stable spec for the language.
- kahlonel 7y ago
  Where did you get this 80%/20% figures from?
  - carlmr 7y ago
    Rough numbers from experience of what these analyzers discover and what actually turns out to be a bug, vs. What rust keeps you from doing out of the box. I could have said a lot or a little, but I wanted to convey an idea of how much and how little. Lacking a strict type system, discriminated unions, if-expressions (they exist in C but are often discouraged because of readability concerns), match expressions, macros that are AST members, procedural macros, guaranteed mutability restrictions with the borrow checker, etc. are things that a coding rule and analyzer can't bring into a language like C. Most importantly no module system to keep yourself somewhat isolated from third party code that you have no control over. Add to that that you have humans checking each violation whether they think it will cause problems. Humans fixing these. And in a lot of cases humans not fixing these. Then you're actually still left with a lot of code that à stricter compiler like Rust or Ada would have rejected in the first place.
- nickpsecurity 7y ago
  Remember there's tools that can prove absence of or detect many classes of error in C with no runtime checks. RV-Match and Astree Analyzer come to mind. Plus all kinds of test generators and a verified compiler. Plus lots of open tooling to do same thing. Safety-critical vendors buy that kind of stuff more than most C shops. C subset with such tooling is safer and more correct than Rust. The advantage of Ada and Rust is they're cheaper and faster to get safe code out of. Businesses will like that. I don't know how compiler qualification plays out these days.
  - carlmr 7y ago
    I'll repeat this from another comment. There are a few things a coding standard like Misra can't do for you. Lacking a strict type system, discriminated unions, if-expressions (they exist in C but are often discouraged because of readability concerns), match expressions, macros that are AST members, procedural macros, guaranteed mutability restrictions with the borrow checker, etc. are things that a coding rule and analyzer can't bring into a language like C. Most importantly no module system to keep yourself somewhat isolated from third party code that you have no control over. Add to that that you have humans checking each violation whether they think it will cause problems. Humans fixing these. And in a lot of cases humans not fixing these. Then you're actually still left with a lot of code that a stricter compiler like Rust or Ada would have rejected in the first place.
    - pjmlp 7y ago
      True, but many companies still try the shortcut of MISRA plus cheaper C devs, than paying for Ada compilers plus more skilled developers.
    - blub 7y ago
      Your other comment is irrelevant in this subthread, because neither RV-Match nor Astree are coding standards. Furthermore, there's zero proof that e.g. macros, match or variant types have any impact on code quality. Bringing the module system into this is really grasping at straws.
irundebian 7y ago
How does Rust compare to Spark/Ada?
- nickpsecurity 7y ago
  I don't know them well enough to compare. Haven't been coding in a while. Best resource on Ada to do that comparison is Barnes: https://www.adacore.com/books/safe-and-secure-software https://www.adacore.com/books/safe-and-secure-software SPARK is a subset without pointers that feeds information about the program into solvers that prove absence of common classes of errors like overflows and divide by zero. Inspired by Rust, recent work is adding pointers. Praxis' Correct-by-Construction defaulted on Ada with SPARK saved for most critical stuff, esp safety- or security-enforcing. Right now, Rust is mainly ahead of Ada on dealing with the pointer safety and better safe concurrency. Ada's Ravenscar aimed for safety but was restrictive. That's my take.
- pjmlp 7y ago
  Like nichsecurity states, Rust is ahead in pointer safety, but that is being taken care for Ada 2020, even if just a subset. Ada/SPARK wins in almost everything else, it has multiple implementations, proven industrial use since early 80's (first standard was in 1983), IDE tooling, it is a common theme in high security computing conferences, libraries for safety critical domains, and people that know the language. Naturally it has a price disadvantage for FOSS devs that are allergic to GNAT, given that the remaining Ada compilers are well into the enterprise price range.

carlmr 7y ago

Normal rust without warnings to me is much safer than most Misra C compliant code. Misra C is an attempt to avoid 80% of C's undefined behavior and other pitfalls, but those 20% that are left are still worse than most of what can go wrong in rust. The tooling that is needed is mostly productivity tooling, like better code completion (rust analyzer is now pretty promising after RLS kind of stagnated). And maybe better ways to show code coverage. The problem for usage in safety critical areas is mostly certification and having a stable spec for the language.

kahlonel 7y ago
Where did you get this 80%/20% figures from?
- carlmr 7y ago
  Rough numbers from experience of what these analyzers discover and what actually turns out to be a bug, vs. What rust keeps you from doing out of the box. I could have said a lot or a little, but I wanted to convey an idea of how much and how little. Lacking a strict type system, discriminated unions, if-expressions (they exist in C but are often discouraged because of readability concerns), match expressions, macros that are AST members, procedural macros, guaranteed mutability restrictions with the borrow checker, etc. are things that a coding rule and analyzer can't bring into a language like C. Most importantly no module system to keep yourself somewhat isolated from third party code that you have no control over. Add to that that you have humans checking each violation whether they think it will cause problems. Humans fixing these. And in a lot of cases humans not fixing these. Then you're actually still left with a lot of code that à stricter compiler like Rust or Ada would have rejected in the first place.
nickpsecurity 7y ago
Remember there's tools that can prove absence of or detect many classes of error in C with no runtime checks. RV-Match and Astree Analyzer come to mind. Plus all kinds of test generators and a verified compiler. Plus lots of open tooling to do same thing. Safety-critical vendors buy that kind of stuff more than most C shops. C subset with such tooling is safer and more correct than Rust. The advantage of Ada and Rust is they're cheaper and faster to get safe code out of. Businesses will like that. I don't know how compiler qualification plays out these days.
- carlmr 7y ago
  I'll repeat this from another comment. There are a few things a coding standard like Misra can't do for you. Lacking a strict type system, discriminated unions, if-expressions (they exist in C but are often discouraged because of readability concerns), match expressions, macros that are AST members, procedural macros, guaranteed mutability restrictions with the borrow checker, etc. are things that a coding rule and analyzer can't bring into a language like C. Most importantly no module system to keep yourself somewhat isolated from third party code that you have no control over. Add to that that you have humans checking each violation whether they think it will cause problems. Humans fixing these. And in a lot of cases humans not fixing these. Then you're actually still left with a lot of code that a stricter compiler like Rust or Ada would have rejected in the first place.
  - pjmlp 7y ago
    True, but many companies still try the shortcut of MISRA plus cheaper C devs, than paying for Ada compilers plus more skilled developers.
  - blub 7y ago
    Your other comment is irrelevant in this subthread, because neither RV-Match nor Astree are coding standards. Furthermore, there's zero proof that e.g. macros, match or variant types have any impact on code quality. Bringing the module system into this is really grasping at straws.

irundebian 7y ago

How does Rust compare to Spark/Ada?

nickpsecurity 7y ago
I don't know them well enough to compare. Haven't been coding in a while. Best resource on Ada to do that comparison is Barnes: https://www.adacore.com/books/safe-and-secure-software https://www.adacore.com/books/safe-and-secure-software SPARK is a subset without pointers that feeds information about the program into solvers that prove absence of common classes of errors like overflows and divide by zero. Inspired by Rust, recent work is adding pointers. Praxis' Correct-by-Construction defaulted on Ada with SPARK saved for most critical stuff, esp safety- or security-enforcing. Right now, Rust is mainly ahead of Ada on dealing with the pointer safety and better safe concurrency. Ada's Ravenscar aimed for safety but was restrictive. That's my take.
pjmlp 7y ago
Like nichsecurity states, Rust is ahead in pointer safety, but that is being taken care for Ada 2020, even if just a subset. Ada/SPARK wins in almost everything else, it has multiple implementations, proven industrial use since early 80's (first standard was in 1983), IDE tooling, it is a common theme in high security computing conferences, libraries for safety critical domains, and people that know the language. Naturally it has a price disadvantage for FOSS devs that are allergic to GNAT, given that the remaining Ada compilers are well into the enterprise price range.