4 ms·
On the other hand, Go code is a lot easier to audit. The kind of logic bug that the Rust compiler prevents due to stronger typing is typically a crash in Go, n
by lima 7y ago
On the other hand, Go code is a lot easier to audit.
The kind of logic bug that the Rust compiler prevents due to stronger typing is typically a crash in Go, not a security issue.
- nicoburns 7y agoDisagree on this. In Rust I can read most of the information I need to know straight from the function signatures. In Go I have to go through every line of code (and there are often a lot of lines due to Go's lack of expressive power).
- lima 7y agoIn Rust code I audit, I typically have to jump through multiple layers of abstraction and cleverness, while Go code is straight forward and boring.
- nicoburns 7y agoI guess it's a matter of preference. If something is abstracted, then you only have to audit it once (and often you can count on someone else having audited it). With Go code, everything is new and unique, so there are a lot more opportunities to introduce bugs.
- Quekid5 7y agoNot to be argumentative, honestly, that sound pretty laughable if you don't have an equivalent of an algebraic effect system (or similar). A "function" in Rust can do a whole bunch of stuff that is not signaled by its type signature.
- nicoburns 7y agoMutability / immutability is in the function signatures, and that goes a long way. It's not as good as an effect system of course. But along with global variables barely being a thing in Rust, it goes a long way to cutting out the common course of bugs.