6 ms·

As someone that deals with a chromium-based codebase everyday, i dont think this is a good idea at all. Unnecessary overcomplication on the codebase, making it

As someone that deals with a chromium-based codebase everyday, i dont think this is a good idea at all. Unnecessary overcomplication on the codebase, making it more difficult to understand. (Rust and C++ are complex beasts) The only thing i could think of, is to replace the tools that are mostly in Python.. But this will be a lot of work. I guess maybe Google wants to employ good Rust enginneers and need to have some "playground" for them. Swift on the other way, will have native C++ interop, and soon will give the ability to manage the memory ownership the same way C++ and Rust does (not just defaulting to ref-count).. Once Swift have those properties we will have one more good contender in the same arena as C++, Rust and Zig.

deleted 6y ago
[deleted]
nilkn 6y ago
I doubt the point is to offer people a playground but rather to find a way to write new code in a language that is memory safe by default. Browsers are notoriously plagued by bugs related to memory safety so there’s quite a lot of motivation for at least considering this path.
- oscargrouch 6y ago
  That is the problem with default narratives, they dont adapt well to every case. Chromium codebase is a massive codebase. It works, its efficient and fast, its sophisticated and complex, its well tested, had all sort of bugs that was taken out of them. Its really well written C++ code with modern ownership semantics. So a lot of mistakes that are used as boogeyman to convince people to use Rust are barely problems you really face. And no matter what wonders Rust promisses, a lot of bugs would get back there in case of rewriting things. Rust can make a very good point when the thing to be rewritten is in C (if is not a billion dollar codebase like Linux). But with big codebases, well written and modern C++ it doesnt make sense at all. I get it why someone would start a new project in Rust though.. but the things dont add up when we talk about big codebases already coded with good C++ practices.
  - kllrnohj 6y ago
    > So a lot of mistakes that are used as boogeyman to convince people to use Rust are barely problems you really face. https://bugs.chromium.org/p/project-zero/issues/list?q=product%3Achrome&can=1 https://bugs.chromium.org/p/project-zero/issues/list?q=produ... This year alone saw 2 issues from Project Zero in Chrome that would have been prevented by Rust - both OOB accesses, one with a helping of data racing. Chromium is an incredibly security-sensitive piece of software, and that really is an excellent fit for Rust. It's not a boogeyman argument and the Chromium team themselves are the ones pursuing it, it's not being forced on them.
    - oscargrouch 6y ago
      I have no doubt that Rust could save some sort of bugs. If you read all the comment i´ve made, you will see that we are talking about a massive codebase already coded in C++. Giving the time it is alive, all the engineering hours, investiments, tools, etc.. most of the bugs that Rust could have prevented right on the beggining are already covered (Chrome also uses fuzzers and static analysis tools to automate C++ code) > This year alone saw 2 issues from Project Zero in Chrome that would have been prevented by Rust Thanks for making my point even clearer. If you really knew the size of the codebase, having only 2 issues on Project Zero is kind of a compliment to Chrome. By the way, it was yesterday, that i´ve saw a research with fuzzers applied in C, C++ and Rust codebases. In that research, Rust had the same overall count of bugs and even some 'zero day' sort of ones not any different from C++ and C codebases (maybe just better than the C one). Its a pitty i can find where it is (I´ve saw it on Twitter, but its pretty recent). > Chromium is an incredibly security-sensitive piece of software, and that really is an excellent fit for Rust. It's not a boogeyman argument and the Chromium team themselves are the ones pursuing it, it's not being forced on them. A Chrome started from zero in 2020? probably.. but thats not the reality here. Millions of lines of C++ code, and its not just a matter of language, but the knowledge and people with the know-how to write those pieces.. Thats why im saying is not worth it..
      - mrich 6y ago
        You also have to consider the huge investment that testing takes. Not only person days spent writing tests, but also infrastructure costs for running fuzzers, huge test suites and so on. And although the code base is already there and tested, it constantly changes, so there is no way to just incrementally test it. At some point you have to make some advances in the way you approach software development, not everything can be handled by brute force.
modeless 6y ago
The security benefits of Rust outweigh those concerns. Almost all C++ code in Chromium is security sensitive. Even if it is sandboxed it can be part of an exploit chain to get to a sandbox escape. Adopting more secure languages should be a long term goal of the project.
roca 6y ago
Rust and Swift are not in the same arena as C++ and Zig. The former offer memory safety and the latter don't --- a critical distinction, since the main reason Rust exists is to provide memory safety in contexts where C++ has traditionally been dominant.
- oscargrouch 6y ago
  Thats because you have divided the languages by properties and i´ve originally divided them over the class of software that can be written in those languages. More as "system language" category, where you can code OS´s, JIT compilers, Browsers or any time/memory sensitive kind of software. Thats why they were packed together. Classically, those sort of things could be only coded in C and C++ as the attempts in doing them in "higher level" languages mostly failed.
deleted 6y ago
[deleted]

deleted 6y ago

[deleted]

nilkn 6y ago

I doubt the point is to offer people a playground but rather to find a way to write new code in a language that is memory safe by default. Browsers are notoriously plagued by bugs related to memory safety so there’s quite a lot of motivation for at least considering this path.

oscargrouch 6y ago
That is the problem with default narratives, they dont adapt well to every case. Chromium codebase is a massive codebase. It works, its efficient and fast, its sophisticated and complex, its well tested, had all sort of bugs that was taken out of them. Its really well written C++ code with modern ownership semantics. So a lot of mistakes that are used as boogeyman to convince people to use Rust are barely problems you really face. And no matter what wonders Rust promisses, a lot of bugs would get back there in case of rewriting things. Rust can make a very good point when the thing to be rewritten is in C (if is not a billion dollar codebase like Linux). But with big codebases, well written and modern C++ it doesnt make sense at all. I get it why someone would start a new project in Rust though.. but the things dont add up when we talk about big codebases already coded with good C++ practices.
- kllrnohj 6y ago
  > So a lot of mistakes that are used as boogeyman to convince people to use Rust are barely problems you really face. https://bugs.chromium.org/p/project-zero/issues/list?q=product%3Achrome&can=1 https://bugs.chromium.org/p/project-zero/issues/list?q=produ... This year alone saw 2 issues from Project Zero in Chrome that would have been prevented by Rust - both OOB accesses, one with a helping of data racing. Chromium is an incredibly security-sensitive piece of software, and that really is an excellent fit for Rust. It's not a boogeyman argument and the Chromium team themselves are the ones pursuing it, it's not being forced on them.
  - oscargrouch 6y ago
    I have no doubt that Rust could save some sort of bugs. If you read all the comment i´ve made, you will see that we are talking about a massive codebase already coded in C++. Giving the time it is alive, all the engineering hours, investiments, tools, etc.. most of the bugs that Rust could have prevented right on the beggining are already covered (Chrome also uses fuzzers and static analysis tools to automate C++ code) > This year alone saw 2 issues from Project Zero in Chrome that would have been prevented by Rust Thanks for making my point even clearer. If you really knew the size of the codebase, having only 2 issues on Project Zero is kind of a compliment to Chrome. By the way, it was yesterday, that i´ve saw a research with fuzzers applied in C, C++ and Rust codebases. In that research, Rust had the same overall count of bugs and even some 'zero day' sort of ones not any different from C++ and C codebases (maybe just better than the C one). Its a pitty i can find where it is (I´ve saw it on Twitter, but its pretty recent). > Chromium is an incredibly security-sensitive piece of software, and that really is an excellent fit for Rust. It's not a boogeyman argument and the Chromium team themselves are the ones pursuing it, it's not being forced on them. A Chrome started from zero in 2020? probably.. but thats not the reality here. Millions of lines of C++ code, and its not just a matter of language, but the knowledge and people with the know-how to write those pieces.. Thats why im saying is not worth it..
    - mrich 6y ago
      You also have to consider the huge investment that testing takes. Not only person days spent writing tests, but also infrastructure costs for running fuzzers, huge test suites and so on. And although the code base is already there and tested, it constantly changes, so there is no way to just incrementally test it. At some point you have to make some advances in the way you approach software development, not everything can be handled by brute force.

modeless 6y ago

The security benefits of Rust outweigh those concerns. Almost all C++ code in Chromium is security sensitive. Even if it is sandboxed it can be part of an exploit chain to get to a sandbox escape. Adopting more secure languages should be a long term goal of the project.

roca 6y ago

Rust and Swift are not in the same arena as C++ and Zig. The former offer memory safety and the latter don't --- a critical distinction, since the main reason Rust exists is to provide memory safety in contexts where C++ has traditionally been dominant.

oscargrouch 6y ago
Thats because you have divided the languages by properties and i´ve originally divided them over the class of software that can be written in those languages. More as "system language" category, where you can code OS´s, JIT compilers, Browsers or any time/memory sensitive kind of software. Thats why they were packed together. Classically, those sort of things could be only coded in C and C++ as the attempts in doing them in "higher level" languages mostly failed.

deleted 6y ago

[deleted]