3 ms·

I've heard this kind of argument a lot and it's getting tiresome when we just keep seeing the same old preventable bugs being a problem time and time again. Yes

I've heard this kind of argument a lot and it's getting tiresome when we just keep seeing the same old preventable bugs being a problem time and time again. Yes, a kernel written in a safe language will still have security bugs. But it would absolutely have a very large positive impact. And any problems with safe languages can be worked around with a bit of imagination, especially with the level of effort already required to write a whole OS with a large number of hardware drivers.

naasking 6y ago
Rust would help with drivers, not so much with the kernel itself. Drivers run in user space in Fuschia, so you should be able to use any language you want.
- tbodt 6y ago
  *Fuchsia
deleted 6y ago
[deleted]
fragmede 6y ago
If you turn off all the safety checks, is Rust still safe? It seems a microkernel architecture allows for the kernel to be as small as possible, with the scheduler and drivers and everything written in a safe language in user-space. In that case, it is anything other than vanity that says the kernel is better off being written in a "safe" language with all the safeties turned off, compared to a unsafe language?
- modeless 6y ago
  1. Fuchsia is not a microkernel, according to themselves. [1] 2. You don't have to turn off safety checks in all of the code. Only having to audit the unsafe code is still a huge win. You're vastly overstating the amount of code that can't be safe. 3. Fuchsia has many components outside of the kernel that should have been written in safe languages but weren't. 4. It's funny that you use the word vanity. I think it perfectly describes the attitude that you're smart enough to write a nontrivial project in C/C++ without any of the many classes of preventable bugs that safe languages fix. Or that a few parts of your code requiring unsafe behavior somehow elevate the whole project into an elite class that doesn't need safety. [1] https://fuchsia.dev/fuchsia-src/concepts https://fuchsia.dev/fuchsia-src/concepts

naasking 6y ago

Rust would help with drivers, not so much with the kernel itself. Drivers run in user space in Fuschia, so you should be able to use any language you want.

tbodt 6y ago
*Fuchsia

deleted 6y ago

[deleted]

fragmede 6y ago

If you turn off all the safety checks, is Rust still safe? It seems a microkernel architecture allows for the kernel to be as small as possible, with the scheduler and drivers and everything written in a safe language in user-space. In that case, it is anything other than vanity that says the kernel is better off being written in a "safe" language with all the safeties turned off, compared to a unsafe language?

modeless 6y ago
1. Fuchsia is not a microkernel, according to themselves. [1] 2. You don't have to turn off safety checks in all of the code. Only having to audit the unsafe code is still a huge win. You're vastly overstating the amount of code that can't be safe. 3. Fuchsia has many components outside of the kernel that should have been written in safe languages but weren't. 4. It's funny that you use the word vanity. I think it perfectly describes the attitude that you're smart enough to write a nontrivial project in C/C++ without any of the many classes of preventable bugs that safe languages fix. Or that a few parts of your code requiring unsafe behavior somehow elevate the whole project into an elite class that doesn't need safety. [1] https://fuchsia.dev/fuchsia-src/concepts https://fuchsia.dev/fuchsia-src/concepts