5 ms·

Disclaimer: Rust groupie. Technically no (only for half of libraries) but effectively yes, if you're comparing to C and C++. The fact that there might be an `u

Disclaimer: Rust groupie. Technically no (only for half of libraries) but effectively yes, if you're comparing to C and C++. The fact that there might be an `unsafe` somewhere in your dependency tree just means that instead of being there being a 0% chance of a memory bug, there's 0.0001%. Whereas a C/C++ codebase of moderate size is virtually guaranteed to have many (orders of magnitude might be off but point stands).

Zababa 5y ago
I think the problem here is not the absolute safety but the illusion of safety. You approach problems differently when you expect memory bugs to appear compared to thinking the chance is 0%.
- joshuamorton 5y ago
  I don't think this is as strong a claim here as you think. The point of unsafe is to point you toward the areas you need to audit. Unsafe code can't be proven memory safe by the compiler [...but the rest can be]. It's far easier to audit 10 or 100 LoC of unsafe rust than 10 or 100 thousand of C++. And even in C++ there are subsets of the language that are supposedly memory safe. But even when writing in those subsets I'm not convinced that the abstractions I'm building on are as well validated as rust.
- yakubin 5y ago
  A study of the frequency of memory corruption in rust programs would be useful here. If the real-world frequency is let's say <0.1% of bugs uncovered, then I say this mindset is a blessing. Working with C++ the feeling of paranoia you have with 1/3[1] of bugs reported, that maybe again it's memory corruption, is sucking the energy out of developers. [1]: That's the frequency of this paranoia creeping in that I observed, not of detected memory corruption, but that too I think would be counted in an integer number of percents IME.
  - Zababa 5y ago
    That's a great point. Their study is a good starting point but it's hard to get anything concrete out of it. I hope they can continue with something like what you proposed.
  - pornel 5y ago
    The real-world data shows that most Rust libraries fail due to (memory-safe) panics or logic errors leading to resource exhaustion, but plain old memory corruption is quite rare: https://github.com/rust-fuzz/trophy-case https://github.com/rust-fuzz/trophy-case
- pcwalton 5y ago
  > You approach problems differently when you expect memory bugs to appear compared to thinking the chance is 0%. The chance is never 0%, and nobody should be thinking that way. Memory safety bugs routinely arise in JITs (e.g. JavaScript engine CVEs). In fact, memory safety issues routinely arise in CPUs (e.g. rowhammer). In reality, terms like "memory safety" are rarely ever exact, but they're still useful descriptions. Practically, people should be thinking about frequencies, not in black and white.
  - cogman10 5y ago
    Yup. I've created a memory leak in java. Not a "I forgot to free memory in a map" memory leak but a honest to goodness "This JVM is allocating heap space and losing track of that allocation". Something that required me to install a special malloc in the VM to track down the leak. This was using standard libraries (You can do it too! Go play with the Deflater and Inflater API and you'll find it makes calls off to Zlib. If not properly handled you end up leaking heap allocations). That was the first and only time I've ran into that issue, but I ran into that issue. The guardrails rust gives you are essentially the same that the JVM gives you. That is, use only safe code and (barring a compiler bug) you are safe. However, bad things COULD (not will) happen if you use unsafe blocks. Just like bad things can happen in JNI blocks or places where Java makes use of C libraries for functionality. And that is what makes rust fantastic. It's got memory safety up there with JVM safety without a garbage collector. It even has nifty keywords (unsafe) to keep developers on their toes when they need it. Just like Java's JNI or Pythons C extensions. In fact, I'd argue that rust unsafe ends up being more safe than either JNI or C extensions primarily because it is something that can be audited very quickly across all rust code bases. Have a memory issue? It's in the unsafe block.
- adkadskhj 5y ago
  There is no illusion of safety. It's 100% safe, within the code you right, if you don't use unsafe. If there is unsafe in code you use (write or shared), it's a handful of lines which you can nearly grep for it's so easy to locate. Rust devs (like myself) aren't illusioned into believing that my code and _everything below it_ is 100% safe. However i can positively assure you my code is 100% safe. Well, assuming no bug in Rust-lang/compiler. My _programs_ are not guaranteed to be 100% safe unless no unsafe is used, but Rust lets you know for certain what is safe, and what is unsafe. The point isn't absolute safety in your program. The point is absolute safety where you think there is absolute safety. To strictly know what is unsafe. And to reduce the total lines that are unsafe. edit: I'm confused by the downvotes, what is incorrect or controversial about this?
simion314 5y ago
Let's not forget that there are other languages that are memory safe and might be good enough for many tasks, so limiting the comparison only with C/C++ feels unfair to me.
- vlovich123 5y ago
  Every serious C/C++ shop I've seen is seriously considering incorporating or switching to Rust. I don't think that's true for many other languages unless they would otherwise be switching to an unsafe language like C/C++ for performance reasons, which is probably a minority.
  - simion314 5y ago
    Are they switching mid project and doing the "Rewrite It in Rust" meme? Or only for new project? If for new projects what type of project that is not some kernel, browser or some low level library is Rust the best tool for the job? For most type of projects I am thinking Python,Java, C#, C++ still is better .
    - jensvdh 5y ago
      Game Servers?
    - Jetrel 5y ago
      Any codecs or anything like that seem like a screamingly good target. Right now they're one of our most egregious sources of security vulnerabilities (mostly due to a lot of hands-on bit-twiddling that results in a lot of possibilities for overflow). It's gotten bad enough that a number of system developers (browsers, OSes) have been shifting to a model where codecs are strictly sandboxed, and just get a single binary input blob, and a single output blob, and don't get any other kind of access to the system they're on - it's a scorched earth problem, but it really is that bad. The thing about trying to write one with Rust is, if you actually 'went with the flow of the language' and didn't just immediately pop into `unsafe`, you'd be able to write a really safe codec. -but- The real payoff is that the performance would be surprisingly good - usually a suggestion like the one I just made would absolutely wreck performance, but one of the big things about Rust is that because it lets you describe what your intent is as a programmer in such higher-level terms (despite being a machine-level language), it gives the compiler a lot more information about the scope of your intent, which opens the floodgates to potential optimizations. For a really easy example - Rust does all variables as "immutable by default". When you're programming in C, and something is compiling your code, there are tons of opportunities where you'd go "oh, well we already calculated this, why don't we just cache it?" But the compiler can't, because it doesn't actually know what you, the human, know - that that thing won't change. Because that knowledge is available to the compiler through Rust, the compiler actually DOES know, so tons of things can get inlined, cached, and otherwise optimized for you which you'd otherwise have to do by hand. Usually when people do these sorts of things by hand, they'll ace a couple key optimizations (usually things that show up in profiling hotspots) and completely overlook hundreds, even thousands of other potential optimizations. There are tons of other "high level intent" things that give the compiler more info it can use to optimize, but the "immutability by default" one is a really easy one to explain.

Zababa 5y ago

I think the problem here is not the absolute safety but the illusion of safety. You approach problems differently when you expect memory bugs to appear compared to thinking the chance is 0%.

joshuamorton 5y ago
I don't think this is as strong a claim here as you think. The point of unsafe is to point you toward the areas you need to audit. Unsafe code can't be proven memory safe by the compiler [...but the rest can be]. It's far easier to audit 10 or 100 LoC of unsafe rust than 10 or 100 thousand of C++. And even in C++ there are subsets of the language that are supposedly memory safe. But even when writing in those subsets I'm not convinced that the abstractions I'm building on are as well validated as rust.
yakubin 5y ago
A study of the frequency of memory corruption in rust programs would be useful here. If the real-world frequency is let's say <0.1% of bugs uncovered, then I say this mindset is a blessing. Working with C++ the feeling of paranoia you have with 1/3[1] of bugs reported, that maybe again it's memory corruption, is sucking the energy out of developers. [1]: That's the frequency of this paranoia creeping in that I observed, not of detected memory corruption, but that too I think would be counted in an integer number of percents IME.
- Zababa 5y ago
  That's a great point. Their study is a good starting point but it's hard to get anything concrete out of it. I hope they can continue with something like what you proposed.
- pornel 5y ago
  The real-world data shows that most Rust libraries fail due to (memory-safe) panics or logic errors leading to resource exhaustion, but plain old memory corruption is quite rare: https://github.com/rust-fuzz/trophy-case https://github.com/rust-fuzz/trophy-case
pcwalton 5y ago
> You approach problems differently when you expect memory bugs to appear compared to thinking the chance is 0%. The chance is never 0%, and nobody should be thinking that way. Memory safety bugs routinely arise in JITs (e.g. JavaScript engine CVEs). In fact, memory safety issues routinely arise in CPUs (e.g. rowhammer). In reality, terms like "memory safety" are rarely ever exact, but they're still useful descriptions. Practically, people should be thinking about frequencies, not in black and white.
- cogman10 5y ago
  Yup. I've created a memory leak in java. Not a "I forgot to free memory in a map" memory leak but a honest to goodness "This JVM is allocating heap space and losing track of that allocation". Something that required me to install a special malloc in the VM to track down the leak. This was using standard libraries (You can do it too! Go play with the Deflater and Inflater API and you'll find it makes calls off to Zlib. If not properly handled you end up leaking heap allocations). That was the first and only time I've ran into that issue, but I ran into that issue. The guardrails rust gives you are essentially the same that the JVM gives you. That is, use only safe code and (barring a compiler bug) you are safe. However, bad things COULD (not will) happen if you use unsafe blocks. Just like bad things can happen in JNI blocks or places where Java makes use of C libraries for functionality. And that is what makes rust fantastic. It's got memory safety up there with JVM safety without a garbage collector. It even has nifty keywords (unsafe) to keep developers on their toes when they need it. Just like Java's JNI or Pythons C extensions. In fact, I'd argue that rust unsafe ends up being more safe than either JNI or C extensions primarily because it is something that can be audited very quickly across all rust code bases. Have a memory issue? It's in the unsafe block.
adkadskhj 5y ago
There is no illusion of safety. It's 100% safe, within the code you right, if you don't use unsafe. If there is unsafe in code you use (write or shared), it's a handful of lines which you can nearly grep for it's so easy to locate. Rust devs (like myself) aren't illusioned into believing that my code and _everything below it_ is 100% safe. However i can positively assure you my code is 100% safe. Well, assuming no bug in Rust-lang/compiler. My _programs_ are not guaranteed to be 100% safe unless no unsafe is used, but Rust lets you know for certain what is safe, and what is unsafe. The point isn't absolute safety in your program. The point is absolute safety where you think there is absolute safety. To strictly know what is unsafe. And to reduce the total lines that are unsafe. edit: I'm confused by the downvotes, what is incorrect or controversial about this?

simion314 5y ago

Let's not forget that there are other languages that are memory safe and might be good enough for many tasks, so limiting the comparison only with C/C++ feels unfair to me.

vlovich123 5y ago
Every serious C/C++ shop I've seen is seriously considering incorporating or switching to Rust. I don't think that's true for many other languages unless they would otherwise be switching to an unsafe language like C/C++ for performance reasons, which is probably a minority.
- simion314 5y ago
  Are they switching mid project and doing the "Rewrite It in Rust" meme? Or only for new project? If for new projects what type of project that is not some kernel, browser or some low level library is Rust the best tool for the job? For most type of projects I am thinking Python,Java, C#, C++ still is better .
  - jensvdh 5y ago
    Game Servers?
  - Jetrel 5y ago
    Any codecs or anything like that seem like a screamingly good target. Right now they're one of our most egregious sources of security vulnerabilities (mostly due to a lot of hands-on bit-twiddling that results in a lot of possibilities for overflow). It's gotten bad enough that a number of system developers (browsers, OSes) have been shifting to a model where codecs are strictly sandboxed, and just get a single binary input blob, and a single output blob, and don't get any other kind of access to the system they're on - it's a scorched earth problem, but it really is that bad. The thing about trying to write one with Rust is, if you actually 'went with the flow of the language' and didn't just immediately pop into `unsafe`, you'd be able to write a really safe codec. -but- The real payoff is that the performance would be surprisingly good - usually a suggestion like the one I just made would absolutely wreck performance, but one of the big things about Rust is that because it lets you describe what your intent is as a programmer in such higher-level terms (despite being a machine-level language), it gives the compiler a lot more information about the scope of your intent, which opens the floodgates to potential optimizations. For a really easy example - Rust does all variables as "immutable by default". When you're programming in C, and something is compiling your code, there are tons of opportunities where you'd go "oh, well we already calculated this, why don't we just cache it?" But the compiler can't, because it doesn't actually know what you, the human, know - that that thing won't change. Because that knowledge is available to the compiler through Rust, the compiler actually DOES know, so tons of things can get inlined, cached, and otherwise optimized for you which you'd otherwise have to do by hand. Usually when people do these sorts of things by hand, they'll ace a couple key optimizations (usually things that show up in profiling hotspots) and completely overlook hundreds, even thousands of other potential optimizations. There are tons of other "high level intent" things that give the compiler more info it can use to optimize, but the "immutability by default" one is a really easy one to explain.