3 ms·
Teaching a class about safety in systems code seems like a great idea, and at first glance the class content here seems useful and interesting. I do a lot of OS
by mjb 6y ago
Teaching a class about safety in systems code seems like a great idea, and at first glance the class content here seems useful and interesting. I do a lot of OS-level stuff at work (especially around virtualization and Firecracker), and while safety (and security) are obviously a critical topic for industrial systems, they don't tend to be things that new grads have thought about at all. Great to see that changing (even, as with all curriculum additions, it means covering some other stuff less).
> CS 110 [multiprocessing, multithreading, and networking in C++] is not just about how we do things, but also why – why are things designed the way they are, and if we get certain bugs or performance characteristics, why is that?
That's an interesting take, because I don't see Rust as being more abstracted in this way than C++ is. Obviously it's more abstracted than C, but by the time you get to "modern" C++ you're programming in a much higher-level language than C.
> I also think it’s hard for students to appreciate Rust without having first experienced C and C++.
This part does make sense. Explaining the "why can't we just write C really carefully?" piece to people who haven't experienced trying to do that is going to be harder. As we all know, it is possible to write safe C, but it takes a level of discipline and tooling support that is beyond most undergrads.
> that looks at what is often going wrong in systems and how we can improve practices to build better systems.
I'd love to see more research here too. There's some systematic studies of the causes of bugs in systems code, and obviously a lot of well-known bug patterns (see all of C's string handling). On the other hand, there seems to be fairly little research on the causes of more pernicious and subtle problems that become vulnerabilities (and data corruption, crashes, etc) in systems code.
- mjb 6y agoI'm also biased here, but it seems like Firecracker (https://github.com/firecracker-microvm/firecracker https://github.com/firecracker-microvm/firecracker) and rust-vmm (https://github.com/rust-vmm https://github.com/rust-vmm) would be great things to use as examples in a course like this. Not because it has space to explain the whole virtualization stack (it doesn't), but because things like virtualized devices are both fairly simple (at least at the simple end) and really safety critical.
- ksml 6y ago> That's an interesting take, because I don't see Rust as being more abstracted in this way than C++ is. Obviously it's more abstracted than C, but by the time you get to "modern" C++ you're programming in a much higher-level language than C. I agree, but C++ doesn't force you to write good, modern code, and so in lecture, we are better able to show examples of bad code that well-intentioned people might write and discuss the consequences. Also, you can't directly make syscalls in Rust without using "unsafe" or a library, and it's harder for students to see how programs interact with the kernel when that extra stuff is in the way. I'm checking out Firecracker right now, and it looks like a really neat project! I'd love to talk more about virtualization in the class, especially since I feel that our current curriculum doesn't spend as much time preparing students for the modern cloud computing architectures they are bound to work with. Curious: can you think of any safety issues you've encountered in Rust or bizarre bugs that Rust's type system didn't save you from? Those often make great lecture examples, and while we always remind students that Rust is not a panacea, I don't think we had any good concrete examples.