3 ms·

I don't actually understand your position on this argument at all... maybe you can clarify? I guess it doesn't really matter since it was resolved in a way tha

I don't actually understand your position on this argument at all... maybe you can clarify? I guess it doesn't really matter since it was resolved in a way that satisfies everyone, it just makes me think I'm missing something. If I grep a dependency for `unsafe`, don't find any, but I have UB in my application from that library, I am going to be very, very unhappy.

steveklabnik 6y ago
I wrote it up as a blog post: https://steveklabnik.com/blog/the-cxx-debate https://steveklabnik.com/blog/the-cxx-debate TL;DR: I think this is just regular old composition of Rust features, and that using the library itself is the proof obligation. I can see why others don't like it. I think dtolnay has come to a good compromise.
- Jweb_Guru 6y ago
  All of the examples in your blog post are examples of code that is obviously safe. I think extending that analogy to something as large as a nontrivial C++ library (one you'd need CXX to integrate with) is such a huge stretch that it kind of feels disingenuous as an argument. However, your current stated justification ("using the library is equivalent to unsafe") is at least a little more understandable to me; nonetheless, the standard in Rust is syntactically writing `unsafe` and I'm glad that dtolnay found a compromise that worked for everyone. (I will point out, however, that I still seriously doubt that every single one of these autogenerated functions is safe, and will probably avoid libraries that use CXX for that reason. But at least now someone who hasn't heard of CXX can come to that conclusion independently :)).
  - steveklabnik 6y ago
    Well, I do that partially because I think that it's the core of the issue here. Saying "hey I think this makes it too easy to make mistakes" is a very different argument than "obviously this library is inherently unsound."
    - Jweb_Guru 6y ago
      Well, both can be true (and I am fairly confident that this was the case previously, even though the exact standards for macro unsafety have not been formally established--in the past, for example when adding #[may_dangle] and other unsafe attributes, a way was found to add `unsafe` to the syntax even though Rust lacked a way to do this directly for the attribute in question). But I agree these are different arguments that shouldn't be confused for one another.

steveklabnik 6y ago

I wrote it up as a blog post: https://steveklabnik.com/blog/the-cxx-debate https://steveklabnik.com/blog/the-cxx-debate TL;DR: I think this is just regular old composition of Rust features, and that using the library itself is the proof obligation. I can see why others don't like it. I think dtolnay has come to a good compromise.

Jweb_Guru 6y ago
All of the examples in your blog post are examples of code that is obviously safe. I think extending that analogy to something as large as a nontrivial C++ library (one you'd need CXX to integrate with) is such a huge stretch that it kind of feels disingenuous as an argument. However, your current stated justification ("using the library is equivalent to unsafe") is at least a little more understandable to me; nonetheless, the standard in Rust is syntactically writing `unsafe` and I'm glad that dtolnay found a compromise that worked for everyone. (I will point out, however, that I still seriously doubt that every single one of these autogenerated functions is safe, and will probably avoid libraries that use CXX for that reason. But at least now someone who hasn't heard of CXX can come to that conclusion independently :)).
- steveklabnik 6y ago
  Well, I do that partially because I think that it's the core of the issue here. Saying "hey I think this makes it too easy to make mistakes" is a very different argument than "obviously this library is inherently unsound."
  - Jweb_Guru 6y ago
    Well, both can be true (and I am fairly confident that this was the case previously, even though the exact standards for macro unsafety have not been formally established--in the past, for example when adding #[may_dangle] and other unsafe attributes, a way was found to add `unsafe` to the syntax even though Rust lacked a way to do this directly for the attribute in question). But I agree these are different arguments that shouldn't be confused for one another.