6 ms·

Writing safe C and C++ is even much more difficult than writing Rust code (especially with many developers). And when you are writing kernel code, both safety a

Writing safe C and C++ is even much more difficult than writing Rust code (especially with many developers). And when you are writing kernel code, both safety and performance are crucial.

MrBuddyCasino 6y ago
The problem seems to be to find people who do not just want to write code, but do the administrative parts: "We do not have enough maintainers. We do have a lot of people who write code, we have a fair number of maintainers, but... it's hard to find people who really look at other people's code and funnel that code upstream all the way, eventually, to my tree... It is one of the main issues we have."
- nickez 6y ago
  Finding people willing to review rust must be much easier than finding someone willing to review c.
  - xiphias2 6y ago
    Actually I think the answer is yes, as Rust is much stricter to the person who's contributing the code. If I was asked to review another person's code, I would much prefer reviewing Rust code, as I would be able to concentrate on the logic and the efficiency of the code instead of potential low level mistakes. The code smell in Rust is usually marked with ,,unsafe'', Boxing / reference counters, or dynamic behaviour, which is very easy to search for.
    - verdagon 6y ago
      Is reference counters really a smell? I thought it was the main way to write Rust when the borrow checker is too strict for something you want to do. Vec + generational indices might be the other way, is that preferred over Rc?
      - xiphias2 6y ago
        ,,when the borrow checker is too strict for something you want to do'' Most of the times it isn't. Just as an example here's a random part of serde, the high quality serialization library in Rust: https://github.com/serde-rs/serde/blob/master/serde/src/private/de.rs https://github.com/serde-rs/serde/blob/master/serde/src/priv... The amount of extra automatic memory management is often a good indicator of not well thought out data structures (although of course they are not always needed).
  - uxp100 6y ago
    I guess your point is that c is harder to review? But I suspect there are probably more people who are experts in device driver code and know kernel internals than all people who know rust.
  - jefft255 6y ago
    I'm sorry but this is being in total denial of the real adoption of rust compared to C.
johnisgood 6y ago
> both safety and performance are crucial Why not Ada/SPARK though? Was it ever considered, even?
- fearingreprisal 6y ago
  I don't think so. Despite its ubiquity, the Linux kernel is not actually the golden standard for safety or performance. Not even for code quality. Ada remains the language of choice in areas where safety is actually crucial. Rust isn't going to take it's spot either.
  - johnisgood 6y ago
    I am inclined to agree. By the way: when I first read about Rust and its "safety features" that make it appealing to people, the first programming language that came to mind was Ada. I suppose it lacks the hype (and consequently a vibrant ecosystem, IMO) and people hold absurd misconceptions of the language[1]. :/ I am trying my best to dissipate those misconceptions on Hacker News; hopefully it does not count as shilling. :P If any of you reading this comment is interested, you may want to check out my previous comments regarding Ada.[2] By the way, just to be on topic: I found Linus' opinion on Ada vs Rust here: https://news.ycombinator.com/item?id=20838125 https://news.ycombinator.com/item?id=20838125. He said "We've had the system people who used Modula-2 or Ada, and I have to say Rust looks a lot better than either of those two disasters.". That is all though, he does not get into explaining why he believes Ada to be a disaster. Again, "I do not see any reasons given for why he considers Ada a disaster. Cannot really do much with this opinion as it is." [1] Some people claimed that it is a legacy language which is just simply not true. I would suggest that they give https://blog.adacore.com/ https://blog.adacore.com/ and https://blog.adacore.com/gnat-community-2020-is-here https://blog.adacore.com/gnat-community-2020-is-here a read. [2] https://news.ycombinator.com/item?id=19122884 https://news.ycombinator.com/item?id=19122884 (!) https://news.ycombinator.com/item?id=19245898 https://news.ycombinator.com/item?id=19245898 (!!) https://news.ycombinator.com/item?id=19274244 https://news.ycombinator.com/item?id=19274244 (!!) https://news.ycombinator.com/item?id=19274412 https://news.ycombinator.com/item?id=19274412 https://news.ycombinator.com/item?id=19770405 https://news.ycombinator.com/item?id=19770405 https://news.ycombinator.com/item?id=20776296 https://news.ycombinator.com/item?id=20776296 https://news.ycombinator.com/item?id=20934511 https://news.ycombinator.com/item?id=20934511 (!!) [3] https://news.ycombinator.com/item?id=20939336 https://news.ycombinator.com/item?id=20939336 (!!) https://news.ycombinator.com/item?id=21286061 https://news.ycombinator.com/item?id=21286061 https://news.ycombinator.com/item?id=21286292 https://news.ycombinator.com/item?id=21286292 https://news.ycombinator.com/item?id=21435869 https://news.ycombinator.com/item?id=21435869 (!) https://news.ycombinator.com/item?id=23609499 https://news.ycombinator.com/item?id=23609499 (!!) [3] The last link in that comment returns 404, here is a working one: https://www.ei.tum.de/fileadmin/tueifei/rcs/becker/spark2014-intro.pdf https://www.ei.tum.de/fileadmin/tueifei/rcs/becker/spark2014... If there are any other broken links, please, do let me know!
doonesbury 6y ago
Indeed. This harks back to old debates: - do I really need threads when I can share non-mutable messages or copies of same? Maybe (speed, throughput). Maybe not. Depends. What's clear is I need choice. - how do I get correctness? Rust maybe checks for index bounds. But in C++ I just relegate that to a library and voila std::string/vector. I am concerned for Rust: placing too much emphasis on correctness through language alone seems to be a weak point. Correctness through libraries and augmenting with formal tools seems like a much stronger solution.
- steveklabnik 6y ago
  One of unsafe's big roles is for people to be able to create new kinds of safety outside of the language proper.

Writing safe C and C++ is even much more difficult than writing Rust code (especially with many developers). And when you are writing kernel code, both safety and performance are crucial.

MrBuddyCasino 6y ago

The problem seems to be to find people who do not just want to write code, but do the administrative parts: "We do not have enough maintainers. We do have a lot of people who write code, we have a fair number of maintainers, but... it's hard to find people who really look at other people's code and funnel that code upstream all the way, eventually, to my tree... It is one of the main issues we have."

nickez 6y ago
Finding people willing to review rust must be much easier than finding someone willing to review c.
- xiphias2 6y ago
  Actually I think the answer is yes, as Rust is much stricter to the person who's contributing the code. If I was asked to review another person's code, I would much prefer reviewing Rust code, as I would be able to concentrate on the logic and the efficiency of the code instead of potential low level mistakes. The code smell in Rust is usually marked with ,,unsafe'', Boxing / reference counters, or dynamic behaviour, which is very easy to search for.
  - verdagon 6y ago
    Is reference counters really a smell? I thought it was the main way to write Rust when the borrow checker is too strict for something you want to do. Vec + generational indices might be the other way, is that preferred over Rc?
    - xiphias2 6y ago
      ,,when the borrow checker is too strict for something you want to do'' Most of the times it isn't. Just as an example here's a random part of serde, the high quality serialization library in Rust: https://github.com/serde-rs/serde/blob/master/serde/src/private/de.rs https://github.com/serde-rs/serde/blob/master/serde/src/priv... The amount of extra automatic memory management is often a good indicator of not well thought out data structures (although of course they are not always needed).
- uxp100 6y ago
  I guess your point is that c is harder to review? But I suspect there are probably more people who are experts in device driver code and know kernel internals than all people who know rust.
- jefft255 6y ago
  I'm sorry but this is being in total denial of the real adoption of rust compared to C.

johnisgood 6y ago

> both safety and performance are crucial Why not Ada/SPARK though? Was it ever considered, even?

fearingreprisal 6y ago
I don't think so. Despite its ubiquity, the Linux kernel is not actually the golden standard for safety or performance. Not even for code quality. Ada remains the language of choice in areas where safety is actually crucial. Rust isn't going to take it's spot either.
- johnisgood 6y ago
  I am inclined to agree. By the way: when I first read about Rust and its "safety features" that make it appealing to people, the first programming language that came to mind was Ada. I suppose it lacks the hype (and consequently a vibrant ecosystem, IMO) and people hold absurd misconceptions of the language[1]. :/ I am trying my best to dissipate those misconceptions on Hacker News; hopefully it does not count as shilling. :P If any of you reading this comment is interested, you may want to check out my previous comments regarding Ada.[2] By the way, just to be on topic: I found Linus' opinion on Ada vs Rust here: https://news.ycombinator.com/item?id=20838125 https://news.ycombinator.com/item?id=20838125. He said "We've had the system people who used Modula-2 or Ada, and I have to say Rust looks a lot better than either of those two disasters.". That is all though, he does not get into explaining why he believes Ada to be a disaster. Again, "I do not see any reasons given for why he considers Ada a disaster. Cannot really do much with this opinion as it is." [1] Some people claimed that it is a legacy language which is just simply not true. I would suggest that they give https://blog.adacore.com/ https://blog.adacore.com/ and https://blog.adacore.com/gnat-community-2020-is-here https://blog.adacore.com/gnat-community-2020-is-here a read. [2] https://news.ycombinator.com/item?id=19122884 https://news.ycombinator.com/item?id=19122884 (!) https://news.ycombinator.com/item?id=19245898 https://news.ycombinator.com/item?id=19245898 (!!) https://news.ycombinator.com/item?id=19274244 https://news.ycombinator.com/item?id=19274244 (!!) https://news.ycombinator.com/item?id=19274412 https://news.ycombinator.com/item?id=19274412 https://news.ycombinator.com/item?id=19770405 https://news.ycombinator.com/item?id=19770405 https://news.ycombinator.com/item?id=20776296 https://news.ycombinator.com/item?id=20776296 https://news.ycombinator.com/item?id=20934511 https://news.ycombinator.com/item?id=20934511 (!!) [3] https://news.ycombinator.com/item?id=20939336 https://news.ycombinator.com/item?id=20939336 (!!) https://news.ycombinator.com/item?id=21286061 https://news.ycombinator.com/item?id=21286061 https://news.ycombinator.com/item?id=21286292 https://news.ycombinator.com/item?id=21286292 https://news.ycombinator.com/item?id=21435869 https://news.ycombinator.com/item?id=21435869 (!) https://news.ycombinator.com/item?id=23609499 https://news.ycombinator.com/item?id=23609499 (!!) [3] The last link in that comment returns 404, here is a working one: https://www.ei.tum.de/fileadmin/tueifei/rcs/becker/spark2014-intro.pdf https://www.ei.tum.de/fileadmin/tueifei/rcs/becker/spark2014... If there are any other broken links, please, do let me know!

doonesbury 6y ago

Indeed. This harks back to old debates: - do I really need threads when I can share non-mutable messages or copies of same? Maybe (speed, throughput). Maybe not. Depends. What's clear is I need choice. - how do I get correctness? Rust maybe checks for index bounds. But in C++ I just relegate that to a library and voila std::string/vector. I am concerned for Rust: placing too much emphasis on correctness through language alone seems to be a weak point. Correctness through libraries and augmenting with formal tools seems like a much stronger solution.

steveklabnik 6y ago
One of unsafe's big roles is for people to be able to create new kinds of safety outside of the language proper.