5 ms·
How would requiring learning Rust, which is famously difficult, be the solution to that problem?
by MrBuddyCasino 6y ago
How would requiring learning Rust, which is famously difficult, be the solution to that problem?
- xiphias2 6y agoWriting safe C and C++ is even much more difficult than writing Rust code (especially with many developers). And when you are writing kernel code, both safety and performance are crucial.
- MrBuddyCasino 6y agoThe problem seems to be to find people who do not just want to write code, but do the administrative parts: "We do not have enough maintainers. We do have a lot of people who write code, we have a fair number of maintainers, but... it's hard to find people who really look at other people's code and funnel that code upstream all the way, eventually, to my tree... It is one of the main issues we have."
- nickez 6y agoFinding people willing to review rust must be much easier than finding someone willing to review c.
- xiphias2 6y agoActually I think the answer is yes, as Rust is much stricter to the person who's contributing the code. If I was asked to review another person's code, I would much prefer reviewing Rust code, as I would be able to concentrate on the logic and the efficiency of the code instead of potential low level mistakes. The code smell in Rust is usually marked with ,,unsafe'', Boxing / reference counters, or dynamic behaviour, which is very easy to search for.
- verdagon 6y agoIs reference counters really a smell? I thought it was the main way to write Rust when the borrow checker is too strict for something you want to do. Vec + generational indices might be the other way, is that preferred over Rc?
- xiphias2 6y ago,,when the borrow checker is too strict for something you want to do'' Most of the times it isn't. Just as an example here's a random part of serde, the high quality serialization library in Rust: https://github.com/serde-rs/serde/blob/master/serde/src/private/de.rs https://github.com/serde-rs/serde/blob/master/serde/src/priv... The amount of extra automatic memory management is often a good indicator of not well thought out data structures (although of course they are not always needed).
- uxp100 6y agoI guess your point is that c is harder to review? But I suspect there are probably more people who are experts in device driver code and know kernel internals than all people who know rust.
- jefft255 6y agoI'm sorry but this is being in total denial of the real adoption of rust compared to C.
- johnisgood 6y ago> both safety and performance are crucial Why not Ada/SPARK though? Was it ever considered, even?
- fearingreprisal 6y agoI don't think so. Despite its ubiquity, the Linux kernel is not actually the golden standard for safety or performance. Not even for code quality. Ada remains the language of choice in areas where safety is actually crucial. Rust isn't going to take it's spot either.
- johnisgood 6y agoI am inclined to agree. By the way: when I first read about Rust and its "safety features" that make it appealing to people, the first programming language that came to mind was Ada. I suppose it lacks the hype (and consequently a vibrant ecosystem, IMO) and people hold absurd misconceptions of the language[1]. :/ I am trying my best to dissipate those misconceptions on Hacker News; hopefully it does not count as shilling. :P If any of you reading this comment is interested, you may want to check out my previous comments regarding Ada.[2] By the way, just to be on topic: I found Linus' opinion on Ada vs Rust here: https://news.ycombinator.com/item?id=20838125 https://news.ycombinator.com/item?id=20838125. He said "We've had the system people who used Modula-2 or Ada, and I have to say Rust looks a lot better than either of those two disasters.". That is all though, he does not get into explaining why he believes Ada to be a disaster. Again, "I do not see any reasons given for why he considers Ada a disaster. Cannot really do much with this opinion as it is." [1] Some people claimed that it is a legacy language which is just simply not true. I would suggest that they give https://blog.adacore.com/ https://blog.adacore.com/ and https://blog.adacore.com/gnat-community-2020-is-here https://blog.adacore.com/gnat-community-2020-is-here a read. [2] https://news.ycombinator.com/item?id=19122884 https://news.ycombinator.com/item?id=19122884 (!) https://news.ycombinator.com/item?id=19245898 https://news.ycombinator.com/item?id=19245898 (!!) https://news.ycombinator.com/item?id=19274244 https://news.ycombinator.com/item?id=19274244 (!!) https://news.ycombinator.com/item?id=19274412 https://news.ycombinator.com/item?id=19274412 https://news.ycombinator.com/item?id=19770405 https://news.ycombinator.com/item?id=19770405 https://news.ycombinator.com/item?id=20776296 https://news.ycombinator.com/item?id=20776296 https://news.ycombinator.com/item?id=20934511 https://news.ycombinator.com/item?id=20934511 (!!) [3] https://news.ycombinator.com/item?id=20939336 https://news.ycombinator.com/item?id=20939336 (!!) https://news.ycombinator.com/item?id=21286061 https://news.ycombinator.com/item?id=21286061 https://news.ycombinator.com/item?id=21286292 https://news.ycombinator.com/item?id=21286292 https://news.ycombinator.com/item?id=21435869 https://news.ycombinator.com/item?id=21435869 (!) https://news.ycombinator.com/item?id=23609499 https://news.ycombinator.com/item?id=23609499 (!!) [3] The last link in that comment returns 404, here is a working one: https://www.ei.tum.de/fileadmin/tueifei/rcs/becker/spark2014-intro.pdf https://www.ei.tum.de/fileadmin/tueifei/rcs/becker/spark2014... If there are any other broken links, please, do let me know!
- doonesbury 6y agoIndeed. This harks back to old debates: - do I really need threads when I can share non-mutable messages or copies of same? Maybe (speed, throughput). Maybe not. Depends. What's clear is I need choice. - how do I get correctness? Rust maybe checks for index bounds. But in C++ I just relegate that to a library and voila std::string/vector. I am concerned for Rust: placing too much emphasis on correctness through language alone seems to be a weak point. Correctness through libraries and augmenting with formal tools seems like a much stronger solution.
- steveklabnik 6y agoOne of unsafe's big roles is for people to be able to create new kinds of safety outside of the language proper.
- canofbars 6y agoI have used a bit of rust and c. I found rust significantly easier since the std lib contains a whole lot more useful stuff. And C is starting to get a bad rep like php and cobal have. The next generation of programmers probably won't bother with it and seek jobs using newer and better languages.
- rhn_mk1 6y agoRust in the kernel is not guaranteed to get stdlib. Running on bare metal is often done with `no_std`. Remembering how memory allocation in the kernel can happen in a multitude of ways, I'm not even sure the usual stdlib could be leveraged. Strings, for example, allocate memory implicitly. That being said, apart from a good stdlib, I found Rust much easier than C due to a consistent type syntax, sum types, generics, traits, and the compiler hitting me on the head with lifetime errors.
- wwright 6y agoEven no_std Rust has a lot of nice built-ins, for what it is worth.
- simias 6y agoDriver code has a lot of concurrency and is very unforgiving for any mishandling of memory. If you want to write good kernel code in C you need to have a strong mental model of who owns what, who does what on whom, what can interrupt, what can be interrupted, what shouldn't be interrupted etc... Having the compiler enforce some of these invariants for you might well end up making writing the code easier, not harder. Rust has a steep learning curve, that's absolutely true, but in my experience I feel a lot more at ease writing complicated parallel code with complicated ownership models in Rust than in C. C is a trickster: in practice if you want to write correct C code you have to use a memory model very similar to that of Rust, the main difference being that Rust forces you to do it (mostly) right whereas C will gladly let you write completely broken code.
- fullstop 6y agoDoes Rust handle anything with memory barriers? I can handle concurrency, interrupt handlers, etc, but memory barriers always trouble me.
- steveklabnik 6y agoIt will force your code to be memory safe, but it can't enforce that you have the correct semantics. https://doc.rust-lang.org/std/sync/atomic/fn.fence.html https://doc.rust-lang.org/std/sync/atomic/fn.fence.html exists, but Rust can't force you to say, use the correct ordering.
- roca 6y agoRequiring certain classes of drivers, for example, to be written in Rust could be great for maintainers. The person who submits the code has to do more work up front to satisfy the Rust compiler that there are no ownership issues, data races, etc. Maintainers have less work to do because, assuming the code compiles and does not use unsafe blocks, they can be confident the invariants promised by Rust hold. You have moved work from maintainers to submitters. (But you have also given submitters a way to get quicker, automated feedback on their work.)