2 ms·

Exactly. But many Rust proponents do not communicate that clearly. They often make it sound like unsafe blocks contain the undefined behavior and prevent it fro

Exactly. But many Rust proponents do not communicate that clearly. They often make it sound like unsafe blocks contain the undefined behavior and prevent it from spreading to the rest of the program, which they don't.

masklinn 7y ago
That's very true. The value of unsafe blocks is that they restrict the number of places you need to inspect / audit for UBs. They're just places where you're telling the compiler "I know what I'm doing", once an unsafe blocks has created an UB thing can break anywhere.
- renox 7y ago
  I don't think that's really true, let's suppose that your unsafe code has a presupposition that cause an UB if not met. If this is a bug and you can remove the presupposition, great, but is-it always possible without performance issue? If not, then you have to audit all the usage of the unsafe part.
  - masklinn 7y ago
    > I don't think that's really true It is though. > let's suppose that your unsafe code has a presupposition that cause an UB if not met. If this is a bug It is, or the code should not present as being safe. > but is-it always possible without performance issue? If not, then you have to audit all the usage of the unsafe part. If it's not possible to fix it (or if you don't want to fix it) then the wrapper for that unsafe code should also be unsafe, and it should document its assumptions such that callers can know what to look for. The tautological contract is that safe rust is safe. If it's possible to trigger UB by passing the "wrong" value to a rust function then that function is not safe and must be marked as unsafe itself. An unsafe block means the compiler trusts that you know what you're doing, which is different from lying to the compiler, which is what you're apparently advocating / defending.
the_duke 7y ago
The important distinction is cause vs effect. Only code in unsafe blocks can cause unsafety (ignoring already and yet to be discovered soundness bugs in the compiler [1]). But the effect can easily materialize in any location that uses the unsafe code, or types that go through it. To me this is somewhat obvious, but it's true that this is easily overlooked and should be communicated. To express this better in the type system, Rust would need an effect system. [1] https://github.com/rust-lang/rust/issues?q=is%3Aopen+is%3Aissue+label%3A%22I-unsound+%F0%9F%92%A5%22 https://github.com/rust-lang/rust/issues?q=is%3Aopen+is%3Ais...

masklinn 7y ago

That's very true. The value of unsafe blocks is that they restrict the number of places you need to inspect / audit for UBs. They're just places where you're telling the compiler "I know what I'm doing", once an unsafe blocks has created an UB thing can break anywhere.

renox 7y ago
I don't think that's really true, let's suppose that your unsafe code has a presupposition that cause an UB if not met. If this is a bug and you can remove the presupposition, great, but is-it always possible without performance issue? If not, then you have to audit all the usage of the unsafe part.
- masklinn 7y ago
  > I don't think that's really true It is though. > let's suppose that your unsafe code has a presupposition that cause an UB if not met. If this is a bug It is, or the code should not present as being safe. > but is-it always possible without performance issue? If not, then you have to audit all the usage of the unsafe part. If it's not possible to fix it (or if you don't want to fix it) then the wrapper for that unsafe code should also be unsafe, and it should document its assumptions such that callers can know what to look for. The tautological contract is that safe rust is safe. If it's possible to trigger UB by passing the "wrong" value to a rust function then that function is not safe and must be marked as unsafe itself. An unsafe block means the compiler trusts that you know what you're doing, which is different from lying to the compiler, which is what you're apparently advocating / defending.

the_duke 7y ago

The important distinction is cause vs effect. Only code in unsafe blocks can cause unsafety (ignoring already and yet to be discovered soundness bugs in the compiler [1]). But the effect can easily materialize in any location that uses the unsafe code, or types that go through it. To me this is somewhat obvious, but it's true that this is easily overlooked and should be communicated. To express this better in the type system, Rust would need an effect system. [1] https://github.com/rust-lang/rust/issues?q=is%3Aopen+is%3Aissue+label%3A%22I-unsound+%F0%9F%92%A5%22 https://github.com/rust-lang/rust/issues?q=is%3Aopen+is%3Ais...