5 ms·

> I guess so, but I'd kind of prefer to be able to do everything I want in safe mode. Different people have different needs and want to do different things. It

by adwn 6y ago

> I guess so, but I'd kind of prefer to be able to do everything I want in safe mode. Different people have different needs and want to do different things. It is impossible to satisfy everyone's needs – "do everything I want in safe mode" – both from a practical perspective (the language and the compiler would become incredibly complex and therefore buggy) as well as from a theoretical perspective (you would solve the halting problem, among other impossible feats).

moonchild 6y ago
> language and the compiler would become incredibly complex and therefore buggy Ats[1] isn't in such bad shape. Its type system is much more complex, sure; idiomatic ats proves many interesting programming attributes that rust doesn't. But if you write ats in the same style as rust, the only additional complexity you'll notice is you have to manually drop. > you would solve the halting problem, among other impossible feats ...what? I don't see what the halting problem has to do it. Safe rust programs aren't required to halt; nontermination is safe, even if not necessarily desirable (like memory leakage, which is also allowed for the same reason). 1. http://www.ats-lang.org/ http://www.ats-lang.org/
- adwn 6y ago
  > I don't see what the halting problem has to do it. Is the following code safe? function_xyz(); let p = 0x1234 as *mut u32; p.write(5); It is safe iff function_xyz() does not terminate. To determine whether the code is safe in the general case, the Rust compiler would have to solve the halting problem. Since that is impossible, the compiler uses a heuristic, which defaults to "not safe". It could use a better heuristic, like "Does function_xyz() contain an infinite loop? If yes, the code is safe." But that's of dubious value.
  - moonchild 6y ago
    Treating otherwise unsafe code as safe because nontermination makes it dead doesn't strike me as particularly useful. Is there any other case where knowing the termination status of a function is helpful in proving safety?
    - adwn 6y ago
      > Treating otherwise unsafe code as safe because nontermination makes it dead doesn't strike me as particularly useful. It doesn't matter whether it's useful or not. What matters is that the compiler can't determine whether it's safe or not.

by adwn 6y ago

moonchild 6y ago

> language and the compiler would become incredibly complex and therefore buggy Ats[1] isn't in such bad shape. Its type system is much more complex, sure; idiomatic ats proves many interesting programming attributes that rust doesn't. But if you write ats in the same style as rust, the only additional complexity you'll notice is you have to manually drop. > you would solve the halting problem, among other impossible feats ...what? I don't see what the halting problem has to do it. Safe rust programs aren't required to halt; nontermination is safe, even if not necessarily desirable (like memory leakage, which is also allowed for the same reason). 1. http://www.ats-lang.org/ http://www.ats-lang.org/

adwn 6y ago
> I don't see what the halting problem has to do it. Is the following code safe? function_xyz(); let p = 0x1234 as *mut u32; p.write(5); It is safe iff function_xyz() does not terminate. To determine whether the code is safe in the general case, the Rust compiler would have to solve the halting problem. Since that is impossible, the compiler uses a heuristic, which defaults to "not safe". It could use a better heuristic, like "Does function_xyz() contain an infinite loop? If yes, the code is safe." But that's of dubious value.
- moonchild 6y ago
  Treating otherwise unsafe code as safe because nontermination makes it dead doesn't strike me as particularly useful. Is there any other case where knowing the termination status of a function is helpful in proving safety?
  - adwn 6y ago
    > Treating otherwise unsafe code as safe because nontermination makes it dead doesn't strike me as particularly useful. It doesn't matter whether it's useful or not. What matters is that the compiler can't determine whether it's safe or not.