4 ms·

Zig's approach to safety is quite different to Rust's. As someone who has done a fair amount of security work, I actually prefer Zig's design decisions. I belie

Zig's approach to safety is quite different to Rust's. As someone who has done a fair amount of security work, I actually prefer Zig's design decisions. I believe they make for safer, simpler, more readable programs. Attackers love complex systems, and the majority of low hanging fruit out there is not for lack of memory safety. Also, the more familiar one is with a subject, the less one tends to conflate it with "plenty" of others. Zig is a completely different language to C (while also targeting the same systems space where you would need "unsafe" Rust to get anything done). In fact, it's hard to find too many languages that come close to Zig's comptime, plus the entire array of safety features offered by Zig. Your argument is a weak strawman at best.

est31 5y ago
Note that Rust's strong type system with algebraic types as well as rich set of lints catches more bugs than just memory safety ones. Zig might have some safety features, but it's dwarfed by what Rust has to offer: https://scattered-thoughts.net/writing/how-safe-is-zig/ https://scattered-thoughts.net/writing/how-safe-is-zig/ More importantly, you can cause exploitable crashes in Zig programs while in Rust you need unsafe for it (at some point in the program). And yes, each Rust codebase has unsafe somewhere, but there are quite many codebases that don't have a single line and instead use dependencies that encapsulate the unsafe in a safe to use API.
- jorangreef 5y ago
  How about checked arithmetic? I'm familiar with the post you linked. Again, as someone who has done security work, I was fascinated by footnote 3 under the table: "not by default, but available via compiler setting or by linting against unchecked arithmetic". Would you say also that Rust's macros offer a stronger type system than Zig's comptime? There is this misconception that Rust will make systems secure simply "because memory safety". But this overlooks the most foundational point of systems safety: simplicity. Most failures or exploits (two sides of the same coin really) originate through excessive dimensionality, a point where Rust's complexity unfortunately dwarfs Zig's.
  - steveklabnik 5y ago
    Overflow panics in debug, two's compliment wrapping in release. You can choose a more specific behavior by using specific APIs if you want something specific for overflow in release. In the future, it may be panic-ing in release too. We'll see if the checks get cheap enough.
    - deleted 5y ago
      [deleted]

est31 5y ago

Note that Rust's strong type system with algebraic types as well as rich set of lints catches more bugs than just memory safety ones. Zig might have some safety features, but it's dwarfed by what Rust has to offer: https://scattered-thoughts.net/writing/how-safe-is-zig/ https://scattered-thoughts.net/writing/how-safe-is-zig/ More importantly, you can cause exploitable crashes in Zig programs while in Rust you need unsafe for it (at some point in the program). And yes, each Rust codebase has unsafe somewhere, but there are quite many codebases that don't have a single line and instead use dependencies that encapsulate the unsafe in a safe to use API.

jorangreef 5y ago
How about checked arithmetic? I'm familiar with the post you linked. Again, as someone who has done security work, I was fascinated by footnote 3 under the table: "not by default, but available via compiler setting or by linting against unchecked arithmetic". Would you say also that Rust's macros offer a stronger type system than Zig's comptime? There is this misconception that Rust will make systems secure simply "because memory safety". But this overlooks the most foundational point of systems safety: simplicity. Most failures or exploits (two sides of the same coin really) originate through excessive dimensionality, a point where Rust's complexity unfortunately dwarfs Zig's.
- steveklabnik 5y ago
  Overflow panics in debug, two's compliment wrapping in release. You can choose a more specific behavior by using specific APIs if you want something specific for overflow in release. In the future, it may be panic-ing in release too. We'll see if the checks get cheap enough.
  - deleted 5y ago
    [deleted]