5 ms·

How much use of unsafe is there? 'Pure Rust' counts for little if the code overuses Rust's unsafe features. edit This was a sincere question. I'm glad the ans

How much use of unsafe is there? 'Pure Rust' counts for little if the code overuses Rust's unsafe features. edit This was a sincere question. I'm glad the answer turned out to be that there's very little of it.

est31 6y ago
rg "unsafe " | wc -l tells me there are 19 occurences, for about 13.7k lines of Rust in total. So it's not a lot.
- MaxBarraclough 6y ago
  Good to hear. It's important to ask though. There was an HN discussion a few months back on a Rust program that overused the unsafe features, to the point it may as well have been written in C. Sure enough, it turned out to be full of nasty bugs.
  - nindalf 6y ago
    > to the point it may as well have been written in C Mildly disagree. Even if half the code base is unsafe, that's better than a code base where everything is unsafe. Now I only have to audit half the code base for crazy shit, which is about half the effort. A stronger type system means that even in unsafe land, we can still encode some invariants better. I disagree with this notion that "if you're going to have bugs anyway, what's the point of Rust". Our goal isn't to eliminate every bug in the world, it's to have fewer bugs today than we did yesterday. Rust, even Rust with several unsafes thrown in, helps us achieve that goal.
    - est31 6y ago
      In principle I agree, but note that such projects are not created in a vacuum. Someone who goes out of their way to put that much unsafe into the codebase is more likely to commit mistakes that lead to ub than someone who just writes C stuff.
      - nindalf 6y ago
        > Someone who goes out of their way to put that much unsafe into the codebase is more likely to commit mistakes that lead to ub than someone who just writes C stuff. [citation needed]. And it would be hard to find a citation because most Rust codebases don't have much unsafe. The repo you're thinking of was an anomaly and has since improved a lot.
        pizza234 6y ago
        > I disagree with this notion that "if you're going to have bugs anyway, what's the point of Rust" [...] [citation needed] Well, this can be related to an actual real-world concept, that is "programming in a certain language with the syntax/runtime of another". In my experience, all the times I've seen this happening, the project was just terribly written. I program in Rust, and if I happened to put an excessive¹ amount of unsafe code in Rust, it means that simply, I'm not programming in Rust. In my opinion, in real world this phenomenon happens for beginners, lazy programmers, or bad programmers, especially for Rust, because it has a steep learning curve, and it requires an effort, when designing a project, that other languages don't require. So there is a point, although theoretical, that a good programmer in an unsafe language, can produce a more stable project than a bad programmer in a safe language. With that in mind, I still wish as others to see unsafe languages disappear :-) ¹="excessive" is of course subjective.
- deleted 6y ago
  [deleted]
- Rotten194 6y ago
  Also most of those are actually `#![forbid(unsafe_code)]` declarations or comments. I only see two places where unsafe is actually used, via `UnsafeCell`.
avasthe 6y ago
Why is it even downvoted? Such a downvote heavy community. Plaudits to all involved.
- ffdjjjffjj 6y ago
  Complaining about the use of unsafe as a “gotcha” is a common canard used by people who often don’t understand what it means. On HN at least, it’s usually not a substantial criticism.
  - MaxBarraclough 6y ago
    My comment was neither complaining nor criticising, it was asking. I made this perfectly clear in my edit. A program can qualify as pure Rust without making use of the safety advantages of the Rust language. It's not unreasonable to wonder how much unsafe code there is in a Rust codebase. It matters. Rust is better for having unsafe features, but it opens the door to their overuse, and this shouldn't be ignored. In the SPARK Ada world, there are 'assurance levels' that offer different levels of guarantees. [0] At the 'Silver' level and above, there is a guaranteed absence of runtime errors (such as divide-by-zero, or out-of-bounds array access). Rust doesn't have such a scheme. It seems reasonable to wonder about overuse of unsafe features (as fuzzy as that is), as a very rough approximation. [0] https://blog.adacore.com/from-ada-to-platinum-spark-a-case-study-for-reusable-bounded-stacks https://blog.adacore.com/from-ada-to-platinum-spark-a-case-s...
- viraptor 6y ago
  Because pure-rust, as in, not relying on bindings to external git libraries is independent from using "unsafe" in the code. For me the question is misguided. There are reasons to prefer a pure-rust code, even if the whole crate was unsafe.
  - avasthe 6y ago
    He thought there would be more weight to having a completely "safe" implementation. Again, plaudits to all involved.

est31 6y ago

rg "unsafe " | wc -l tells me there are 19 occurences, for about 13.7k lines of Rust in total. So it's not a lot.

MaxBarraclough 6y ago
Good to hear. It's important to ask though. There was an HN discussion a few months back on a Rust program that overused the unsafe features, to the point it may as well have been written in C. Sure enough, it turned out to be full of nasty bugs.
- nindalf 6y ago
  > to the point it may as well have been written in C Mildly disagree. Even if half the code base is unsafe, that's better than a code base where everything is unsafe. Now I only have to audit half the code base for crazy shit, which is about half the effort. A stronger type system means that even in unsafe land, we can still encode some invariants better. I disagree with this notion that "if you're going to have bugs anyway, what's the point of Rust". Our goal isn't to eliminate every bug in the world, it's to have fewer bugs today than we did yesterday. Rust, even Rust with several unsafes thrown in, helps us achieve that goal.
  - est31 6y ago
    In principle I agree, but note that such projects are not created in a vacuum. Someone who goes out of their way to put that much unsafe into the codebase is more likely to commit mistakes that lead to ub than someone who just writes C stuff.
    - nindalf 6y ago
      > Someone who goes out of their way to put that much unsafe into the codebase is more likely to commit mistakes that lead to ub than someone who just writes C stuff. [citation needed]. And it would be hard to find a citation because most Rust codebases don't have much unsafe. The repo you're thinking of was an anomaly and has since improved a lot.
      - pizza234 6y ago
        > I disagree with this notion that "if you're going to have bugs anyway, what's the point of Rust" [...] [citation needed] Well, this can be related to an actual real-world concept, that is "programming in a certain language with the syntax/runtime of another". In my experience, all the times I've seen this happening, the project was just terribly written. I program in Rust, and if I happened to put an excessive¹ amount of unsafe code in Rust, it means that simply, I'm not programming in Rust. In my opinion, in real world this phenomenon happens for beginners, lazy programmers, or bad programmers, especially for Rust, because it has a steep learning curve, and it requires an effort, when designing a project, that other languages don't require. So there is a point, although theoretical, that a good programmer in an unsafe language, can produce a more stable project than a bad programmer in a safe language. With that in mind, I still wish as others to see unsafe languages disappear :-) ¹="excessive" is of course subjective.
deleted 6y ago
[deleted]
Rotten194 6y ago
Also most of those are actually `#![forbid(unsafe_code)]` declarations or comments. I only see two places where unsafe is actually used, via `UnsafeCell`.

avasthe 6y ago

Why is it even downvoted? Such a downvote heavy community. Plaudits to all involved.

ffdjjjffjj 6y ago
Complaining about the use of unsafe as a “gotcha” is a common canard used by people who often don’t understand what it means. On HN at least, it’s usually not a substantial criticism.
- MaxBarraclough 6y ago
  My comment was neither complaining nor criticising, it was asking. I made this perfectly clear in my edit. A program can qualify as pure Rust without making use of the safety advantages of the Rust language. It's not unreasonable to wonder how much unsafe code there is in a Rust codebase. It matters. Rust is better for having unsafe features, but it opens the door to their overuse, and this shouldn't be ignored. In the SPARK Ada world, there are 'assurance levels' that offer different levels of guarantees. [0] At the 'Silver' level and above, there is a guaranteed absence of runtime errors (such as divide-by-zero, or out-of-bounds array access). Rust doesn't have such a scheme. It seems reasonable to wonder about overuse of unsafe features (as fuzzy as that is), as a very rough approximation. [0] https://blog.adacore.com/from-ada-to-platinum-spark-a-case-study-for-reusable-bounded-stacks https://blog.adacore.com/from-ada-to-platinum-spark-a-case-s...
viraptor 6y ago
Because pure-rust, as in, not relying on bindings to external git libraries is independent from using "unsafe" in the code. For me the question is misguided. There are reasons to prefer a pure-rust code, even if the whole crate was unsafe.
- avasthe 6y ago
  He thought there would be more weight to having a completely "safe" implementation. Again, plaudits to all involved.