4 ms·
> A downstream consumer might not need to use the keyword unsafe, but by calling such a function, they have de facto lost memory safety. That's a silly definit
by eloff 5y ago
> A downstream consumer might not need to use the keyword unsafe, but by calling such a function, they have de facto lost memory safety.
That's a silly definition of memory safety. You can't write a non trivial rust program that doesn't use unsafe in it's dependencies. No interior mutability, no allocation, no containers.
The point is these uses of unsafe are checked by the author to ensure they can't introduce unsound behavior through the exposed safe API.
> Rust in practice is likely not as safe an ecosystem as C#, because Rust users are more likely to use unsafe blocks for performance tricks.
Sort of agree with you here. Unsafe code is rare in C#. But C# has race conditions so some kinds of bugs are more common. But C# isn't as suited for systems programming type of problems or really high performance code.
- incrudible 5y agoIt is an honest definition of memory safety. The fact that you can not write a non trivial Rust program without unsafe dependencies is not an argument against that definition. Most languages considered memory safe have some sort virtual machine model where non trivial programs can be written without any use of unsafe. The virtual machine implementation itself may be unsafe of course, but that is a pretty solid boundary. In Rust, that boundary is easily crossed by anyone, for any reason, to the point where it sips into 50% of dependencies, as this paper shows. I am not saying that C# evades this issue in principle, obviously it has the same functionality, it is just not used as liberally. Concurrency is orthogonal.
- woodruffw 5y ago> Most languages considered memory safe have some sort virtual machine model where non trivial programs can be written without any use of unsafe. With the obvious exception of JS in the browser, I don’t believe this is true: Python, Ruby, Java, C# all have widely used unsafe native escape hatches that are regularly found in dependency trees. All you have to do is misuse these interfaces, which is significantly easier than in Rust.
- incrudible 5y agoRead carefully: The premise is that you can't write a non-trivial program in Rust without using unsafe. It's true that most language implementations have an escape hatch in the form of a foreign function interface and/or they have native extension modules, nevertheless non-trivial programs can be written without using them. Conversely, using such facilities is often a reason why a program may not be portable between multiple language implementations.
- eloff 5y agoNo, that's not my premise. You can't write a non trivial rust program that doesn't use unsafe in it's dependencies, often the standard library. But this is true of every other programming language I'm aware of. So if you want to define memory safety to be something never achieved in practice, fine, but that's not a useful definition in my books.
- incrudible 5y ago> No, that's not my premise. You can't write a non trivial rust program that doesn't use unsafe in it's dependencies, often the standard library. Same difference, because the use of unsafe is transitive. There is no distinction between "unsafe-but-part-of-the-standard-library" and "unsafe". > But this is true of every other programming language I'm aware of. So if you want to define memory safety to be something never achieved in practice, fine, but that's not a useful definition in my books. I don't. I already made that distinction further up in the thread, you can read that and reply there if you have any objections.
- eloff 5y agoSo nothing is memory safe by your definition then. Languages like C# are more memory safe than Rust because the uses of unsafe code are fewer and more concentrated in the runtime where bugs are more easily caught. I think that's a fair comparison.
- 5y ago