9 ms·

I find it strange Rust marketing people are insisting the language is safe yet it can't dynamically allocate a byte of memory without some unsafe code. In lang

I find it strange Rust marketing people are insisting the language is safe yet it can't dynamically allocate a byte of memory without some unsafe code. In languages like C# or Java the whole standard library is written in C# or Java. Somewhere deep inside implementation of new() there's a function call to C malloc() or some equivalent. The important difference, native API surface is much smaller this way. All else being equal, an API with a small surface has better chances to be secure than a large API.

zozbot234 6y ago
> I find it strange Rust marketing people are insisting the language is safe yet it can't dynamically allocate a byte of memory without some unsafe code. In languages like C# or Java the whole standard library is written in C# or Java. ... C# has an unsafe feature quite comparable to Rust. Java has its sun.misc.Unsafe module. These approaches are not meaningfully better than what Rust does.
- Const-me 6y ago
  > C# has an unsafe feature quite comparable to Rust. The standard library, and 95% of third-party libraries, don’t use these features. Rust standard library contains a huge amount of unsafe code, with a history of security bugs there: https://medium.com/@shnatsel/how-rusts-standard-library-was-vulnerable-for-years-and-nobody-noticed-aebf0503c3d6 https://medium.com/@shnatsel/how-rusts-standard-library-was-...
kangalioo 6y ago
Rust tries to circumvent the _need_ for manual allocation entirely by providing plenty of high level constructs (Box, Vec, Rc, etc.) that you can do to safely and easily do what you might accomplish with manual memory allocation in C
- Const-me 6y ago
  All these constructs are implemented in terms of unsafe code. This makes the unsafe API surface (which, in the context of security, becomes attack surface) very large. Compare to Java or C#. Vast majority of stuff, including these collections, are implemented on top of memory-safe primitives. Usually (unless explicitly writing unsafe code which most people don’t do), the only attack surface is the VM itself. The attack surface is much smaller in comparison, both JVM and CLR are very simple from the outside, 202 and 234 instructions, respectively. The attack surface is well-contained, third-party C# or Java libraries don’t patch the VMs, while unsafe rust is used in many third-party crates not just in the standard library. Also, these VMs are well-audited (most of the implementations are open source now) and widely used all over the industry, including very security sensitive applications like banks and military.

zozbot234 6y ago

> I find it strange Rust marketing people are insisting the language is safe yet it can't dynamically allocate a byte of memory without some unsafe code. In languages like C# or Java the whole standard library is written in C# or Java. ... C# has an unsafe feature quite comparable to Rust. Java has its sun.misc.Unsafe module. These approaches are not meaningfully better than what Rust does.

Const-me 6y ago
> C# has an unsafe feature quite comparable to Rust. The standard library, and 95% of third-party libraries, don’t use these features. Rust standard library contains a huge amount of unsafe code, with a history of security bugs there: https://medium.com/@shnatsel/how-rusts-standard-library-was-vulnerable-for-years-and-nobody-noticed-aebf0503c3d6 https://medium.com/@shnatsel/how-rusts-standard-library-was-...

kangalioo 6y ago

Rust tries to circumvent the _need_ for manual allocation entirely by providing plenty of high level constructs (Box, Vec, Rc, etc.) that you can do to safely and easily do what you might accomplish with manual memory allocation in C

Const-me 6y ago
All these constructs are implemented in terms of unsafe code. This makes the unsafe API surface (which, in the context of security, becomes attack surface) very large. Compare to Java or C#. Vast majority of stuff, including these collections, are implemented on top of memory-safe primitives. Usually (unless explicitly writing unsafe code which most people don’t do), the only attack surface is the VM itself. The attack surface is much smaller in comparison, both JVM and CLR are very simple from the outside, 202 and 234 instructions, respectively. The attack surface is well-contained, third-party C# or Java libraries don’t patch the VMs, while unsafe rust is used in many third-party crates not just in the standard library. Also, these VMs are well-audited (most of the implementations are open source now) and widely used all over the industry, including very security sensitive applications like banks and military.