3 ms·

> In three years' time, Rust could very well not be so hot, and a new new thing might take over its social role. Zig could conceivably be that thing. Zig is to

by est31 5y ago

> In three years' time, Rust could very well not be so hot, and a new new thing might take over its social role. Zig could conceivably be that thing. Zig is totally different from Rust. For starters, it does not have a safe subset of the language that prevents an entire class of bugs. It's slightly nicer C. There are plenty of languages like that.

jorangreef 5y ago
Zig's approach to safety is quite different to Rust's. As someone who has done a fair amount of security work, I actually prefer Zig's design decisions. I believe they make for safer, simpler, more readable programs. Attackers love complex systems, and the majority of low hanging fruit out there is not for lack of memory safety. Also, the more familiar one is with a subject, the less one tends to conflate it with "plenty" of others. Zig is a completely different language to C (while also targeting the same systems space where you would need "unsafe" Rust to get anything done). In fact, it's hard to find too many languages that come close to Zig's comptime, plus the entire array of safety features offered by Zig. Your argument is a weak strawman at best.
- est31 5y ago
  Note that Rust's strong type system with algebraic types as well as rich set of lints catches more bugs than just memory safety ones. Zig might have some safety features, but it's dwarfed by what Rust has to offer: https://scattered-thoughts.net/writing/how-safe-is-zig/ https://scattered-thoughts.net/writing/how-safe-is-zig/ More importantly, you can cause exploitable crashes in Zig programs while in Rust you need unsafe for it (at some point in the program). And yes, each Rust codebase has unsafe somewhere, but there are quite many codebases that don't have a single line and instead use dependencies that encapsulate the unsafe in a safe to use API.
  - jorangreef 5y ago
    How about checked arithmetic? I'm familiar with the post you linked. Again, as someone who has done security work, I was fascinated by footnote 3 under the table: "not by default, but available via compiler setting or by linting against unchecked arithmetic". Would you say also that Rust's macros offer a stronger type system than Zig's comptime? There is this misconception that Rust will make systems secure simply "because memory safety". But this overlooks the most foundational point of systems safety: simplicity. Most failures or exploits (two sides of the same coin really) originate through excessive dimensionality, a point where Rust's complexity unfortunately dwarfs Zig's.
    - steveklabnik 5y ago
      Overflow panics in debug, two's compliment wrapping in release. You can choose a more specific behavior by using specific APIs if you want something specific for overflow in release. In the future, it may be panic-ing in release too. We'll see if the checks get cheap enough.
      - deleted 5y ago
        [deleted]
nicklecompte 5y ago
I don’t want to get into a Zig-vs-Rust debate (nor should anyone!) but I did take some exception to this: > [Zig is a] slightly nicer C. There are plenty of languages like that. Are there “plenty of [actively supported] languages like that?” The design space of relatively simple, typesafe, imperative native programs strikes me as rather unexplored since the early 90s. At least I can’t think of many languages I would consider a nicer alternative to C - indeed actual C alternatives like Pascal and Fortran are arguably less nice. Maybe this is my ignorance. There are various languages “between” C and C++ in terms of abstraction and complexity, and the space of “somewhat C-like” languages is heavily explored (D, Java, C#, Objective-C, and in a different sense Ada or Swift). There are plenty of alternatives to C++. But Zig is one of the only ones that’s not dramatically more complex than ISO C. Happy to be corrected if I am missing something obvious (I mostly do functional programming).

by est31 5y ago

jorangreef 5y ago

Zig's approach to safety is quite different to Rust's. As someone who has done a fair amount of security work, I actually prefer Zig's design decisions. I believe they make for safer, simpler, more readable programs. Attackers love complex systems, and the majority of low hanging fruit out there is not for lack of memory safety. Also, the more familiar one is with a subject, the less one tends to conflate it with "plenty" of others. Zig is a completely different language to C (while also targeting the same systems space where you would need "unsafe" Rust to get anything done). In fact, it's hard to find too many languages that come close to Zig's comptime, plus the entire array of safety features offered by Zig. Your argument is a weak strawman at best.

est31 5y ago
Note that Rust's strong type system with algebraic types as well as rich set of lints catches more bugs than just memory safety ones. Zig might have some safety features, but it's dwarfed by what Rust has to offer: https://scattered-thoughts.net/writing/how-safe-is-zig/ https://scattered-thoughts.net/writing/how-safe-is-zig/ More importantly, you can cause exploitable crashes in Zig programs while in Rust you need unsafe for it (at some point in the program). And yes, each Rust codebase has unsafe somewhere, but there are quite many codebases that don't have a single line and instead use dependencies that encapsulate the unsafe in a safe to use API.
- jorangreef 5y ago
  How about checked arithmetic? I'm familiar with the post you linked. Again, as someone who has done security work, I was fascinated by footnote 3 under the table: "not by default, but available via compiler setting or by linting against unchecked arithmetic". Would you say also that Rust's macros offer a stronger type system than Zig's comptime? There is this misconception that Rust will make systems secure simply "because memory safety". But this overlooks the most foundational point of systems safety: simplicity. Most failures or exploits (two sides of the same coin really) originate through excessive dimensionality, a point where Rust's complexity unfortunately dwarfs Zig's.
  - steveklabnik 5y ago
    Overflow panics in debug, two's compliment wrapping in release. You can choose a more specific behavior by using specific APIs if you want something specific for overflow in release. In the future, it may be panic-ing in release too. We'll see if the checks get cheap enough.
    - deleted 5y ago
      [deleted]

nicklecompte 5y ago

I don’t want to get into a Zig-vs-Rust debate (nor should anyone!) but I did take some exception to this: > [Zig is a] slightly nicer C. There are plenty of languages like that. Are there “plenty of [actively supported] languages like that?” The design space of relatively simple, typesafe, imperative native programs strikes me as rather unexplored since the early 90s. At least I can’t think of many languages I would consider a nicer alternative to C - indeed actual C alternatives like Pascal and Fortran are arguably less nice. Maybe this is my ignorance. There are various languages “between” C and C++ in terms of abstraction and complexity, and the space of “somewhat C-like” languages is heavily explored (D, Java, C#, Objective-C, and in a different sense Ada or Swift). There are plenty of alternatives to C++. But Zig is one of the only ones that’s not dramatically more complex than ISO C. Happy to be corrected if I am missing something obvious (I mostly do functional programming).