4 ms·

It doesn’t say it “works badly” it says the borrow checker can’t protect against external modifications to the file while memory-mapped, which has a host of iss

It doesn’t say it “works badly” it says the borrow checker can’t protect against external modifications to the file while memory-mapped, which has a host of issues in C as well. You can mmap files in Rust just fine, but it’s generally as dangerous as it is in C.

amelius 6y ago
But that may be of little solace. If you snapshot your entire heap into an mmapped file for fast I/O, then basically the entire advantage of Rust is gone.
- ReactiveJelly 6y ago
  > If you snapshot your entire heap into an mmapped file for fast I/O, I've never heard of this trick. And my first reaction is "That would be a nightmare of memory unsafety if I did it in C++" What's it used for? IPC?
  - amelius 6y ago
    You have to combine it with other techniques, e.g. journaling to make it safe, but this is not always necessary (e.g. when using large read-only data-structures)
  - loeg 6y ago
    I think emacs (used to?) do something awful like this. https://lwn.net/Articles/707615/ https://lwn.net/Articles/707615/
  - howinteresting 6y ago
    I'd call mmaping data structures into memory an advanced systems programming trick which can result in a nice performance boost but which also has some severe drawbacks (portability across big/little endian architectures and internal pointers being two examples). I know some very skilled C++ and Rust developers who can pull it off. If you're at that skill level, Rust is not going to get in your way because you're just going to use unsafe and throw some sanitizers and fuzzers at it. I wouldn't trust myself to implement it.
- bluejekyll 6y ago
  Is there literally no other code in the application? Rust has plenty of situations where you do unsafe things but wrap that in safe APIs. If you’re returning regions of that mmapped file, for example, a lifetime can be associated to those references to ensure that those are valid for the duration of the file being mmapped in the program. It can be used to ensure that if you need to write back to that mmapped file (inside the same program) that there are no existing references to it, because those would be invalid after an update to the file. You need to do the same in C, but there are no guardrails you can build in C to make that same assurance.
bakatubas 6y ago
I don’t get this obsession with “dangerous.” Honestly, what does that even mean? I think a better word is “error-prone.” Danger is more like, “oh my god a crocodile!”
- steveklabnik 6y ago
  > Honestly, what does that even mean? It has a very specific meaning in Rust: the user can cause memory unsafety if they make a mistake. > I think a better word is “error-prone.” The issue with the connotation there is that it's not about the rate of problems, it's about them going from "impossible" to "possible."
- amelius 6y ago
  There can be real danger when the code is used in certain applications. For example when controlling the gate of the crocodile cage in a zoo.
- kortex 6y ago
  Concurrency bugs can absolutely cause dangerous danger of the deadly variety: https://en.m.wikipedia.org/wiki/Therac-25 https://en.m.wikipedia.org/wiki/Therac-25
  - bakatubas 6y ago
    Unfortunately, as is most always the case of negligence instead of some particular language features: “A commission attributed the primary cause to general poor software design and development practices rather than single-out specific coding errors. In particular, the software was designed so that it was realistically impossible to test it in a clean automated way.“ Ergo, concurrency doesn’t kill people, people do.
    - majewsky 6y ago
      You sound like you make a refutation, but you really don't. This whole discussion is about giving tools to developers that are systematically less error-prone, which your quote suggests would have been helpful to that specific development team.

amelius 6y ago

But that may be of little solace. If you snapshot your entire heap into an mmapped file for fast I/O, then basically the entire advantage of Rust is gone.

ReactiveJelly 6y ago
> If you snapshot your entire heap into an mmapped file for fast I/O, I've never heard of this trick. And my first reaction is "That would be a nightmare of memory unsafety if I did it in C++" What's it used for? IPC?
- amelius 6y ago
  You have to combine it with other techniques, e.g. journaling to make it safe, but this is not always necessary (e.g. when using large read-only data-structures)
- loeg 6y ago
  I think emacs (used to?) do something awful like this. https://lwn.net/Articles/707615/ https://lwn.net/Articles/707615/
- howinteresting 6y ago
  I'd call mmaping data structures into memory an advanced systems programming trick which can result in a nice performance boost but which also has some severe drawbacks (portability across big/little endian architectures and internal pointers being two examples). I know some very skilled C++ and Rust developers who can pull it off. If you're at that skill level, Rust is not going to get in your way because you're just going to use unsafe and throw some sanitizers and fuzzers at it. I wouldn't trust myself to implement it.
bluejekyll 6y ago
Is there literally no other code in the application? Rust has plenty of situations where you do unsafe things but wrap that in safe APIs. If you’re returning regions of that mmapped file, for example, a lifetime can be associated to those references to ensure that those are valid for the duration of the file being mmapped in the program. It can be used to ensure that if you need to write back to that mmapped file (inside the same program) that there are no existing references to it, because those would be invalid after an update to the file. You need to do the same in C, but there are no guardrails you can build in C to make that same assurance.

bakatubas 6y ago

I don’t get this obsession with “dangerous.” Honestly, what does that even mean? I think a better word is “error-prone.” Danger is more like, “oh my god a crocodile!”

steveklabnik 6y ago
> Honestly, what does that even mean? It has a very specific meaning in Rust: the user can cause memory unsafety if they make a mistake. > I think a better word is “error-prone.” The issue with the connotation there is that it's not about the rate of problems, it's about them going from "impossible" to "possible."
amelius 6y ago
There can be real danger when the code is used in certain applications. For example when controlling the gate of the crocodile cage in a zoo.
kortex 6y ago
Concurrency bugs can absolutely cause dangerous danger of the deadly variety: https://en.m.wikipedia.org/wiki/Therac-25 https://en.m.wikipedia.org/wiki/Therac-25
- bakatubas 6y ago
  Unfortunately, as is most always the case of negligence instead of some particular language features: “A commission attributed the primary cause to general poor software design and development practices rather than single-out specific coding errors. In particular, the software was designed so that it was realistically impossible to test it in a clean automated way.“ Ergo, concurrency doesn’t kill people, people do.
  - majewsky 6y ago
    You sound like you make a refutation, but you really don't. This whole discussion is about giving tools to developers that are systematically less error-prone, which your quote suggests would have been helpful to that specific development team.