7 ms·

There is no reason to assume it is the "Best Chance". There are a lot of other chances too, some even since more than two decades (e.g. Ada/Spark). Even C++ its

by Rochus 6y ago

There is no reason to assume it is the "Best Chance". There are a lot of other chances too, some even since more than two decades (e.g. Ada/Spark). Even C++ itself has not yet shot all the powder. And just as one can write secure code in C++, it will turn out in time that even with Rust not everything is as secure as propaganda would have you believe. I would be interested to know if this is really the official opinion of Microsoft, or if someone just wants to make a name for himself.

zozbot234 6y ago
Ada doesn't have a borrow checker.
- Rochus 6y ago
  Why should it need one?
  - wtetzner 6y ago
    To support freeing heap allocations in a memory-safe way without relying on a GC.
    - Rochus 6y ago
      see https://news.ycombinator.com/item?id=15874273 https://news.ycombinator.com/item?id=15874273
      - deleted 6y ago
        [deleted]
      - deleted 6y ago
        [deleted]
    - Rochus 6y ago
      Here another one: https://news.ycombinator.com/item?id=17601789 https://news.ycombinator.com/item?id=17601789
      - wtetzner 6y ago
        Looks like that is effectively a borrow checker. So, the reason to need one still seems valid.
        Rochus 6y ago
        You asked for a BC in Ada, but this is SPARK, which we use for formal verification of Ada code, so there is no need to also have it in Ada; besides that you can do much more in SPARK than just BC and even Ada has much more powerful type features than any other language which in very many cases makes memory management or pointer handling unnecessary (e.g. you can declare much more things by value on the stack, even with variable lenght data structures).
        wtetzner 6y ago
        > You asked for a BC in Ada, but this is SPARK, which we use for formal verification of Ada code, so there is no need to also have it in Ada; Sorry, I didn't. I was just pointing out why you'd want a borrow checker. I think you might be referring to another poster.
        Rochus 6y ago
        Oops, my bad.
sfkdjf9j3j 6y ago
Can you elaborate on the "propaganda" comment?
- Rochus 6y ago
  Attract people with promises based on unwarranted denigration of other technologies. They should present appropriate, independent studies instead, not just claim something. In the article itself you can read that even Microsoft with its billions of lines of C++ code will certainly never switch to Rust. And in C++ 23 something similar to what is not even thought through in Rust today is also planned.
  - zozbot234 6y ago
    > And in C++ 23 something similar to what is not even thought through in Rust today is also planned. Source? The closest thing in C++ to what Rust offers today is the C++ Core Guidelines https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines but these are best-effort in nature and do not have a goal of comprehensively ensuring soundness or memory-safety. And I'm not sure why you're implyng that the Rust featureset "isn't even thought through" when the Rust Belt project has been doing a lot of work on modeling it in a principled and clearly-understandable way, and this has already contributed usefully to the design of newer Rust features.
    - Rochus 6y ago
      E.g. https://github.com/isocpp/CppCoreGuidelines/blob/master/docs/Lifetime.pdf https://github.com/isocpp/CppCoreGuidelines/blob/master/docs...
      - steveklabnik 6y ago
        As mentioned by your parent, matching Rust’s abilities here is a non-goal for this project. Still very glad to see it!
    - Rochus 6y ago
noisem4ker 6y ago
Momentum counts, and Ada/Spark have little mindshare right now. If next to nobody ever adopted them in the last two decades unless mandated by requirements, what chance do they have for the near future? For whatever reason, Rust is surging in popularity and is currently the most promising bet for memory safety to become commonplace in the system programming circles.
- Rochus 6y ago
  Rust is the new utopia; at the moment there is only the (founded) assumption that you write more secure software with it. Only time will tell whether this is actually the case and whether the same number of security problems will be displayed in Rust applications in ten years' time. But as is well known, hope is nourished by promises of salvation.
  - staticassertion 6y ago
    The problem with this attitude is: * The claims aren't baseless. We've seen for decades already that memory safe languages have fewer memory safety issues than languages that are not memory safe. * Asking for hard proof is silly in software. There's tons of research into programming languages and their impact on software projects, across a number of areas, and it's all fairly useless - it's extremely expensive to do right, and impossible to objectively measure. Common sense isn't propaganda.
    - Rochus 6y ago
      > that memory safe languages have fewer memory safety issues than languages That's what I would assume ;-) By the end of the day it's also a question of performance. For embedded, realtime or mobile core technologies there will always be a need to shortcut. > Asking for hard proof is silly in software. Not only in software. That's what the scientific method is for. That needs time. Currently there is a debate whether the switch from Ada to C++ for the F-35 is the cause of all the observed problems and budget overruns. There is still not enough data to know. But there was a decade-long track record for Ada in avionics. And C++ also had to establish itself for twenty years before anyone dared to develop an F-35 with it.
jeffdavis 6y ago
Having a minimal runtime is, I believe, a requirement to make any serious headway into a lot C/C++ use cases. The places where minimal runtime is not important have already seen big shifts to garbage-collected languages ~20 years ago. You mentioned Ada, which does have a minimal runtime. It might be interesting if the community and ecosystem made a strong push into general-purpose programming, like rust has. I would give it another try. Rust seems to handle heap allocations more fluidly (or at least closer to what I expect), but perhaps that wouldn't be a deal-breaker if I knew more about progamming in Ada. Rust also has better C integration -- it can match C structure layouts and operate on them seamlessly with rust semantics. But basically, it seems plausible that Ada could work with the right ecosystem around it. Regardless, Ada has had decades to make the leap into general-purpose programming, and it hasn't done so yet. Rust is viable today for a lot of important use cases, and is not far off for a lot of others.
- Rochus 6y ago
  I think the fact that Rust is very popular in the polls, but still hardly ever used, rather indicates that people primarily want to escape from their current dissatisfaction, but then ultimately don't take it seriously with switching to another technology, so as with Ada or others already available. Besides, C++ is also evolving, and formal verification has been possible for many years. There are also proven ways to avoid memory problems. Rust would have to prove itself first. Maybe it solves one problem better, but ten others worse.
  - feanaro 6y ago
    "Hardly ever used" sounds like it might be the result of your personal filter bubble?
    - Rochus 6y ago
      see https://insights.stackoverflow.com/survey/2019 https://insights.stackoverflow.com/survey/2019 Only a small fraction of "Rust fans" are actually using it.
wtetzner 6y ago
People seem to want a language that gives you similar memory handling to C++, which Ada doesn't really do. In any case, developers don't seem to be too keen on adopting Ada. > And just as one can write secure code in C++, it will turn out in time that even with Rust not everything is as secure as propaganda would have you believe. I think the point is more that Rust is memory safe by default, and you have to opt out of it. In C++ on the other hand, memory safety basically falls to the developer, with plenty of crazy pitfalls to watch out for in the language. It's not that it can't be done, it's just harder to do it right. Rust makes the easy, default thing safe, and the unsafe thing requires extra effort.
- Rochus 6y ago
  > In any case, developers don't seem to be too keen on adopting Ada. Yes, unfortunately; the trend seems to go in the opposite direction; but anyway: if I really wanted to switch to something new and spend the effort to invest in new tools and education, then I would rather choose a technology with a decently long track record demonstrating that it fulfills all my expectations because of which I left my original technology. Rust will take one or two decades for this; Ada/Spark has already been through this.
  - zucker42 6y ago
    If everyone adopted this mindset, there'd be no new programming languages because no one would learn them until they'd been around for 20 years. Sometimes it makes sense for companies to take a risk on a new technology.
    - Rochus 6y ago
      If it's your company and your money, then of course you can decide yourself whether you want to take that risk; most likely not immediately in a multi-million dollar project though.
the_mitsuhiko 6y ago
Are there good examples of people replacing C++ code with Ada and Spark?
- Rochus 6y ago
  Unfortunately not that many; I also don't believe that all the exited folks will really switch to Rust. Maybe this one is interesting for you: https://blogs.nvidia.com/blog/2019/02/05/adacore-secure-autonomous-driving/ https://blogs.nvidia.com/blog/2019/02/05/adacore-secure-auto...
entha_saava 6y ago
To be fair, rust is a good systems programming language, for scenarios where correctness is important and runtime footprint must be small. I have no problems with it promoted as a good systems programming language. It seems much more modern than Ada or something and may lend itself better to formal verification. What I hate is rust fanboys' propaganda that rust is great for every purpose including CRUD stuff because crab god moral and borrow checker is moral responsibility. There is lot of dishonest marketing sounding like rust doesn't have cognitive overhead compared to other languages. It gives me an impression that, in best case, it is selection bias among people that successfully learn and use rust, or in worst case, some people trying to show off that they learned a 'hard' language and it is 'easy' for them. Secondly rust community is very political and polarising that many people don't like. It almost seems full of non-STEM-worthy people although they are a vocal minority..
- jevgeni 6y ago
  IMO Rust's cognitive cost is paid upfront. Other popular languages shove that cognitive cost as technical debt into the future. An example from a while back: needing to rewrite your whole original Ruby code base in Scala. Or having to write your own PHP compiler.

by Rochus 6y ago

zozbot234 6y ago

Ada doesn't have a borrow checker.

Rochus 6y ago
Why should it need one?
- wtetzner 6y ago
  To support freeing heap allocations in a memory-safe way without relying on a GC.
  - Rochus 6y ago
    see https://news.ycombinator.com/item?id=15874273 https://news.ycombinator.com/item?id=15874273
    - deleted 6y ago
      [deleted]
    - deleted 6y ago
      [deleted]
  - Rochus 6y ago
    Here another one: https://news.ycombinator.com/item?id=17601789 https://news.ycombinator.com/item?id=17601789
    - wtetzner 6y ago
      Looks like that is effectively a borrow checker. So, the reason to need one still seems valid.
      - Rochus 6y ago
        You asked for a BC in Ada, but this is SPARK, which we use for formal verification of Ada code, so there is no need to also have it in Ada; besides that you can do much more in SPARK than just BC and even Ada has much more powerful type features than any other language which in very many cases makes memory management or pointer handling unnecessary (e.g. you can declare much more things by value on the stack, even with variable lenght data structures).
        wtetzner 6y ago
        > You asked for a BC in Ada, but this is SPARK, which we use for formal verification of Ada code, so there is no need to also have it in Ada; Sorry, I didn't. I was just pointing out why you'd want a borrow checker. I think you might be referring to another poster.
        Rochus 6y ago
        Oops, my bad.

sfkdjf9j3j 6y ago

Can you elaborate on the "propaganda" comment?

Rochus 6y ago
Attract people with promises based on unwarranted denigration of other technologies. They should present appropriate, independent studies instead, not just claim something. In the article itself you can read that even Microsoft with its billions of lines of C++ code will certainly never switch to Rust. And in C++ 23 something similar to what is not even thought through in Rust today is also planned.
- zozbot234 6y ago
  > And in C++ 23 something similar to what is not even thought through in Rust today is also planned. Source? The closest thing in C++ to what Rust offers today is the C++ Core Guidelines https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines but these are best-effort in nature and do not have a goal of comprehensively ensuring soundness or memory-safety. And I'm not sure why you're implyng that the Rust featureset "isn't even thought through" when the Rust Belt project has been doing a lot of work on modeling it in a principled and clearly-understandable way, and this has already contributed usefully to the design of newer Rust features.
  - Rochus 6y ago
    E.g. https://github.com/isocpp/CppCoreGuidelines/blob/master/docs/Lifetime.pdf https://github.com/isocpp/CppCoreGuidelines/blob/master/docs...
    - steveklabnik 6y ago
      As mentioned by your parent, matching Rust’s abilities here is a non-goal for this project. Still very glad to see it!
  - Rochus 6y ago

noisem4ker 6y ago

Momentum counts, and Ada/Spark have little mindshare right now. If next to nobody ever adopted them in the last two decades unless mandated by requirements, what chance do they have for the near future? For whatever reason, Rust is surging in popularity and is currently the most promising bet for memory safety to become commonplace in the system programming circles.

Rochus 6y ago
Rust is the new utopia; at the moment there is only the (founded) assumption that you write more secure software with it. Only time will tell whether this is actually the case and whether the same number of security problems will be displayed in Rust applications in ten years' time. But as is well known, hope is nourished by promises of salvation.
- staticassertion 6y ago
  The problem with this attitude is: * The claims aren't baseless. We've seen for decades already that memory safe languages have fewer memory safety issues than languages that are not memory safe. * Asking for hard proof is silly in software. There's tons of research into programming languages and their impact on software projects, across a number of areas, and it's all fairly useless - it's extremely expensive to do right, and impossible to objectively measure. Common sense isn't propaganda.
  - Rochus 6y ago
    > that memory safe languages have fewer memory safety issues than languages That's what I would assume ;-) By the end of the day it's also a question of performance. For embedded, realtime or mobile core technologies there will always be a need to shortcut. > Asking for hard proof is silly in software. Not only in software. That's what the scientific method is for. That needs time. Currently there is a debate whether the switch from Ada to C++ for the F-35 is the cause of all the observed problems and budget overruns. There is still not enough data to know. But there was a decade-long track record for Ada in avionics. And C++ also had to establish itself for twenty years before anyone dared to develop an F-35 with it.

jeffdavis 6y ago

Having a minimal runtime is, I believe, a requirement to make any serious headway into a lot C/C++ use cases. The places where minimal runtime is not important have already seen big shifts to garbage-collected languages ~20 years ago. You mentioned Ada, which does have a minimal runtime. It might be interesting if the community and ecosystem made a strong push into general-purpose programming, like rust has. I would give it another try. Rust seems to handle heap allocations more fluidly (or at least closer to what I expect), but perhaps that wouldn't be a deal-breaker if I knew more about progamming in Ada. Rust also has better C integration -- it can match C structure layouts and operate on them seamlessly with rust semantics. But basically, it seems plausible that Ada could work with the right ecosystem around it. Regardless, Ada has had decades to make the leap into general-purpose programming, and it hasn't done so yet. Rust is viable today for a lot of important use cases, and is not far off for a lot of others.

Rochus 6y ago
I think the fact that Rust is very popular in the polls, but still hardly ever used, rather indicates that people primarily want to escape from their current dissatisfaction, but then ultimately don't take it seriously with switching to another technology, so as with Ada or others already available. Besides, C++ is also evolving, and formal verification has been possible for many years. There are also proven ways to avoid memory problems. Rust would have to prove itself first. Maybe it solves one problem better, but ten others worse.
- feanaro 6y ago
  "Hardly ever used" sounds like it might be the result of your personal filter bubble?
  - Rochus 6y ago
    see https://insights.stackoverflow.com/survey/2019 https://insights.stackoverflow.com/survey/2019 Only a small fraction of "Rust fans" are actually using it.

wtetzner 6y ago

People seem to want a language that gives you similar memory handling to C++, which Ada doesn't really do. In any case, developers don't seem to be too keen on adopting Ada. > And just as one can write secure code in C++, it will turn out in time that even with Rust not everything is as secure as propaganda would have you believe. I think the point is more that Rust is memory safe by default, and you have to opt out of it. In C++ on the other hand, memory safety basically falls to the developer, with plenty of crazy pitfalls to watch out for in the language. It's not that it can't be done, it's just harder to do it right. Rust makes the easy, default thing safe, and the unsafe thing requires extra effort.

Rochus 6y ago
> In any case, developers don't seem to be too keen on adopting Ada. Yes, unfortunately; the trend seems to go in the opposite direction; but anyway: if I really wanted to switch to something new and spend the effort to invest in new tools and education, then I would rather choose a technology with a decently long track record demonstrating that it fulfills all my expectations because of which I left my original technology. Rust will take one or two decades for this; Ada/Spark has already been through this.
- zucker42 6y ago
  If everyone adopted this mindset, there'd be no new programming languages because no one would learn them until they'd been around for 20 years. Sometimes it makes sense for companies to take a risk on a new technology.
  - Rochus 6y ago
    If it's your company and your money, then of course you can decide yourself whether you want to take that risk; most likely not immediately in a multi-million dollar project though.

the_mitsuhiko 6y ago

Are there good examples of people replacing C++ code with Ada and Spark?

Rochus 6y ago
Unfortunately not that many; I also don't believe that all the exited folks will really switch to Rust. Maybe this one is interesting for you: https://blogs.nvidia.com/blog/2019/02/05/adacore-secure-autonomous-driving/ https://blogs.nvidia.com/blog/2019/02/05/adacore-secure-auto...

entha_saava 6y ago

To be fair, rust is a good systems programming language, for scenarios where correctness is important and runtime footprint must be small. I have no problems with it promoted as a good systems programming language. It seems much more modern than Ada or something and may lend itself better to formal verification. What I hate is rust fanboys' propaganda that rust is great for every purpose including CRUD stuff because crab god moral and borrow checker is moral responsibility. There is lot of dishonest marketing sounding like rust doesn't have cognitive overhead compared to other languages. It gives me an impression that, in best case, it is selection bias among people that successfully learn and use rust, or in worst case, some people trying to show off that they learned a 'hard' language and it is 'easy' for them. Secondly rust community is very political and polarising that many people don't like. It almost seems full of non-STEM-worthy people although they are a vocal minority..

jevgeni 6y ago
IMO Rust's cognitive cost is paid upfront. Other popular languages shove that cognitive cost as technical debt into the future. An example from a while back: needing to rewrite your whole original Ruby code base in Scala. Or having to write your own PHP compiler.