14 ms·

What Is Rust's Hole Purpose?

65 points by lukastyrychtr 5y ago

akagusu 5y ago
Rust is Pinky and Brain's attempts to take over the world.
- danieleggert 5y ago
  A hole in the ground.
ZeroGravitas 5y ago
Ways to figure out where the bug actually is when using systems built from different parts feels like an underexploited area. Many things in software actually play this role, from obvious thing like unit tests through to using popular software (if it works for everyone else then it's probably your bug). If no one else uses your exact Chipset/OS/language/compiler/library (version) matrix then the bug could be anywhere. I'm not sure it has an official academic name though. Modularity? Re-usability? Safety? Reliability? Predictability? Repeatability? Good ecosystem? There's a few things that overlap and combine.
PaulDavisThe1st 5y ago
This was interesting: > At this point, while reflecting on that topic, I decided to look more into the origins of the drill/hole adage; that diversion led me to a lovely post critiquing the adage, saying it “doesn’t go far enough.” The heart of the argument there is that people don’t want holes either. [... ] but then TFA didn't actually go there for Rust. After laying out a great example of how the purpose of a hole is ultimately about time (and possibly frustration), the author fails to reach a similar end-goal for Rust, despite hinting at it: > But, thinking of the drill/hole adage, I stopped and asked myself: “Who wants safety? Is it an end in itself? If it is merely a means to an end, then to what end?” What is the true end-goal? Saving lives/money/property by avoiding errors?
- 3pt14159 5y ago
  I find it kinda amusing that the New York Times lead reporter on cybersecurity has a book out literally called "This is How They Tell Me the World Ends" and we're on the worlds premier hacker forum pondering about the point of safety in software languages.
  - skybrian 5y ago
    Have you read it? Is it good? Maybe submit a link to a review?
  - PaulDavisThe1st 5y ago
    You seem to be trying to make the point that is should be completely obvious what the point of safety is. And yet so much (not all, but a substantial part) of what that book is about has very little relationship to language safety. Rust will not protect you if there's a backdoor left in the system. Rust will not protect you if there's no password, or absurdly weak passwords. Rust will not protect you if your entire system design is predicated on a perimeter defense with no internal checks. Etc. etc. Now, I'm not so stupid as to believe that we shouldn't do all we can, and that can include language safety. But by itself, that doesn't have a lot to do with the huge end goal laid out in the book, which might be summarized as: be able to build computational systems and networks that are extremely resistant to unintended access, utilization and modification in pursuance of personal, political or national goals".
    - 3pt14159 5y ago
      > And yet so much (not all, but a substantial part) of what that book is about has very little relationship to language safety. Yes, yes. I know that. But we literally have a book floating around around THE END of the WORLD and us nerds can't justify even the first step around fixing these systems. It's like someone asking what good fire hydrants are since they won't help with battery fires.
  - avgcorrection 5y ago
    I can’t believe people care about cybersecurity when climate change is a bigger threat to us all ad nauseam.
Supermancho 5y ago
Interestingly, what the adage left out, is the qualities. People don't just want a hole, without qualification. They want a hole that's reliably uniform (smooth bore, sharp edge), quick and easy to produce, and cost effective. If Rust can avoid more errors with nearly the same performance profile (and control) offered by C, it's an improvement. The Hole purpose is to be a better low level language.
- smoe 5y ago
  Also, there are people that want a hole and there are those, that are selling hole making to others. The latter would indeed want to buy the drill. A restaurant customer doesn't care what knife the chef used. But chefs still choose to get different specialized knifes for different tasks.
- lanstin 5y ago
  Is anyone writing a Python interpreter in Rust? Or an OpenSSL fork? Cert parsing libraries at least? I know there is a project to rewrite coreutils into Rust, seems that would also be a good demo. I don’t think the kernel drivers thing has landed yet, but it is also an interesting project.
  - jcranmer 5y ago
    There's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime https://github.com/bytecodealliance/wasmtime There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/ https://briansmith.org/rustdoc/webpki/ There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challenging, and probably requires large amounts of assembly to guarantee correctness).
  - pjmlp 5y ago
    While not Rust, there are definitely Python implementations in safe languages, namely Python itself, Java and .NET.
dcminter 5y ago
This is (to me) a very odd article. It creates some straw man definitions and points out that Rust doesn't hold up to them, and then gives a more accurate definition and complains that it isn't expansive enough. It concludes by pointing out that unsafe code is unsafe. Speaking personally, Rust offers a rather nice featureful syntax (and libraries), and saves me the trouble of worrying about certain kinds of very typical mistakes. I may want a hole, but a cordless drill with a comfortable hand grip is very likely my tool of choice. Especially thinking back to my father's corded underpowered temperamental drill with the easy to lose chuck key...
- wussboy 5y ago
  My dad always taped the chuck key to the drill's cord. Those were the days...
- avgcorrection 5y ago
  I was surprised to see that it was written by a Rust implementation insider. The first half is very meandering. Please just get to the point and leave footnotes and asterisks for things like “safe”. (Just my preference.)
- cryptonector 5y ago
  Moreover, at some point the rubber meets the road and some "unsafe" code almost certainly must exist at that point. The goal should not be to have zero lines of unsafe code, but to have so few that it is possible to review and understand them and to understand why, though they are "unsafe", they yield safe behavior. Rust does do this!
- lamontcg 5y ago
  > It concludes by pointing out that unsafe code is unsafe. It spent an awful lot of time on that without making very good points. About one paragraph of text could have pointed that reducing the surface area of unsafe code is therefore a good thing, which leads to "rewrite it in rust" which gets you more safe code. There also seemed to be a little bit of conflation of safe code with bug-free code which just isn't possible. Arguing English semantics of words which are being used to describe very specific compiler behavior is going to be a GIGO argument.
garethrowlands 5y ago
Surely the value proposition of Rust is fewer security vulnerabilities than an equivalent C program.
- justbored123 5y ago
- lamontcg 5y ago
  And no garbage collector pauses or tuning.
  - pjmlp 5y ago
    Pauses happens when using Rc types with a cascade deletion of deeply nested data structures, and if Drop are incorrectly written, even a possible stack overflow might occur.
    - zozbot234 5y ago
      > Pauses happens when using Rc types with a cascade deletion of deeply nested data structures True, but this is inherent to deterministic deallocation. Rust is getting local allocator support to make it easier to manage these tradeoffs. (Local allocators are commonly used already in C/C++.)
      - pjmlp 5y ago
        Only the call is deterministic, not how long it takes to return. Local allocators are also a thing in many languages with automatic memory management.
  - garethrowlands 5y ago
    Well, if you just wanted no garbage collector, you could use C.
wrnr 5y ago
This article is focusses on the safety features of Rust the language but this is not something that many developers (or me at least) considered when adopting yet another language. For me I was looking todo computer graphics with something that wasn't c++ but had similar performance characteristics and could compile to WASM. Rust had the best language features for this and the most momentum behind it with things like wgpu and bevy. Fighting with the borrow checker and unsafe Rust is not something I do all day or every day, it is just something you live with.
aranchelk 5y ago
From the title, I was sure this was going to be an article about typed holes.
ibraheemdev 5y ago
For some context, this was written by Felix Klock, a lead of the Rust compiler team: https://github.com/pnkfelix https://github.com/pnkfelix
zozbot234 5y ago
The value proposition of Rust is that you can Rewrite Stuff in it and it's going to generally run faster, with fewer bugs, taking up less RAM and generating less heat in your processor. The rewriting part is the whole point - that's where all the fun is! I'm not sure why so many devs complain about being told to RIIR. Who doesn't want to be using state of the art tools when coding and developing their stuff? Software is eating the world anyway, so why can't Rust eat software?
- beardedetim 5y ago
  I don't want to get paid to write code. I want to get paid to solve problems. My least favorite type of problem to solve is "how do I explain ABC solution in Language 123". I hate it even more when ABC solution is working per any metric the business cares about.
- verdagon 5y ago
  I think greenfield projects in Rust make a lot of sense. However, for some existing projects, the math just doesn't check out. I worked on Google Earth for a few years, and the core was in C++. With ASan and modern C++, memory safety bugs rarely slipped into production... perhaps once every 3-4 months, and this was a million line codebase with 20 engineers working on it. When you consider the cost of a memory safety bug (some users get odd behavior), how rare they happen (because of our good test coverage), and that everything's sandboxed in WASM anyway, there's just not much cost to this kind of memory unsafety bug... and certainly not as much cost as a full rewrite. RIIR makes sense for projects whose memory unsafety causes catastrophic failure. And even then, in some of those cases it makes more sense to use Java or Javascript, which don't expose unsafe operations. RIIR makes sense if someone's doing something with extreme performance requirements, and they're okay with a tiny risk of memory unsafety (from unsafe code). All just my opinion though, I'm sure there are many other great opinions out there.
  - derefr 5y ago
    > and that everything's sandboxed in WASM anyway, there's just not much cost to this kind of memory unsafety bug... Presumably, without the potential for memory-safety bugs, there'd be no need for anything like a WASM sandbox, no? If so, then can't the costs of the WASM sandbox (overhead, potential exploits in the JS/WASM runtime, etc.) be tallied under the column of "costs of memory-safety bugs"? In about the same sense that e.g. the costs associated with running a Web Application Firewall in front of a Wordpress instance, can be blamed on how vulnerable/exploitable Wordpress+PHP are as a stack. If you avoid introducing an attack-surface in the first place, then you don't need to spend effort on guarding it.
justbored123 5y ago
verdagon 5y ago
> If you are interested in helping solve any of these problems, please reach out! Coincidentally, we're working on these problems with Vale [0] by obviating the need for unsafe, while still having single ownership's performance benefits, by taking generational indices (a common Rust/C++ technique) and building them into the language itself, and by moving borrow checking to the region level instead of the object level [1]. Time will tell if it works out! [0] https://vale.dev/ https://vale.dev/ [1] https://verdagon.dev/blog/seamless-fearless-structured-concurrency https://verdagon.dev/blog/seamless-fearless-structured-concu...
- zozbot234 5y ago
  Many PL folks are now looking into ways to generalize Rust's borrow checking approach. Even the Rust community is getting into this kind of stuff with the GhostCell proposal and its many variations. It remains to be seen how such extensions and generalizations might be adopted in a way that's reasonably intuitive and ergonomic.
School-Cotton 5y ago
There is only one language (as far as I know) in the following niche: * compiles to native code with no GC or runtime overhead * Facilities for high-level abstraction well beyond those offered by C * Widely used in the mainstream. That language is C++. If Rust becomes mainstream, it will be the second language in that set. Thus, in my opinion, talking about the value proposition of Rust makes the most sense when comparing it to C++. I find it much easier to write and understand Rust than modern C++, and that’s what makes it valuable, for me.
- dcow 5y ago
  For me Rust and C++ have similar complexity in terms of learning curve and the main difference is where you spend your time. Rust programs have a tendency to work on the first or second try provided you can get them to compile. In C++ it’s easier to rig something up that technically meets the portion of the language spec that the compiler enforces, but who knows if it actually does what you expect and the debug cycle is much longer. Debugging is generally more frustrating and time consuming than simply conceptually massaging your implementation strategy until it fits Rust’s model, at least for me. Also Rust is pretty mainstream at this point.
- ribit 5y ago
  Pretty much that. Safety gimmick aside, Rust is (mostly) what C++ would have been if designed with modern knowledge of programming languages theory and compiler practice in mind. It’s not like Rust brings that much novel things to the table, it is has its roots in ML and friends that have been around for decades. It’s just that we didn’t know how to make ML-type languages fast in the 80-ties. So C++ designers did the best they could given the time period and the circumstances.
  - nu11ptr 5y ago
    Are there other languages with compile time GC prior to Rust? I thought that was a pretty novel feature. I recall an ML variant with region inference, but that was just an optimization I believe for it's runtime GC. Edit: MLKit was the ML dialect I was thinking of - looked it up
k__ 5y ago
People make good money with renting out drills, so I'm not so sure about that analogy.
deleted 5y ago
[deleted]
lanstin 5y ago
I thought of this classic drill article: http://www.team.net/mjb/hawg.html http://www.team.net/mjb/hawg.html Not sure that is the Unix philosophy but definitely the attitude of many 90s C programmers. But also we want power and safety at the same time. A smart matter drill, if you will, that will dissolve when it hits flesh. Rust currently ushers a lot of thought about safety into the coding process, while with C you can start dangerously and then fix later with Valgrind/Purify etc. fun but bad results for OpenSSL or sudo or parsers in general.
ribit 5y ago
I think Rust’s hole purpose is to be an ergonomic language that supports modern practices and generates very fast executables. Safety is a nice thing to have, but that’s just an icing on the cake for folks who need it. For me at least, a proper type system, reasonable ownership model (slices and co), modular programming are worth much more than “safety”.
gameswithgo 5y ago
One small point I disagree with is characterizing using iteration to avoid bounds checks as "wrestling with your environment". At least for most developers, iterating instead of writing for loops by hand is the more natural approach, and I really like that Rust makes the way people WANT to write code the fastest path. Contrast with C# or Javascript where using iterators has performance overhead. So you have to ask yourself (in some domains) if the iterator is worth the overhead. In Rust you just use the iterator any time you can! However I can see how people coming from C might consider the for loop the more natural approach.
- dhosek 5y ago
  I saw a benchmark that indicated that the iterator approach was actually even faster than the loop.
- pjmlp 5y ago
  C# JIT can remove it, specially if PGO is enabled.
Dig1t 5y ago
Speaking by example: If you have one team of 10 people write a browser engine in C++ and another team of 10 people write the same browser engine in safe Rust (or as much safe rust as you can get away with), over a 5 year timespan you'll discover fewer UAF bugs in the Rust-written engine than the C++ one. This is the value prop for any company deciding to use Rust. Obviously every language comes with tradeoffs, but this is concretely what people mean when they throw around the word "safety". The author is also totally correct in pointing out how easy it is to include unsafe Rust in your code by linking unsafe crates. I think this should definitely be an area of discussion and awareness-raising on the part of developers.
- zozbot234 5y ago
  > I think this should definitely be an area of discussion and awareness-raising on the part of developers. It is. There is an unofficial `cargo geiger` tool that will alert you to these issues.
- nlitened 5y ago
  > If you have one team of 10 people write a browser engine in C++ and another team of 10 people write the same browser engine in safe Rust Has it ever been shown that it’s possible to write a full browser engine in Rust? I believe for C++ it has been proven multiple times. If I am not mistaken, Servo hasn’t been finished in 10 years.
  - leshow 5y ago
    > Servo hasn’t been finished in 10 years. Mozilla laid off all their servo developers in 2020 > Has it ever been shown that it’s possible to write a full browser engine in Rust? Why wouldn't it be possible?
    - nlitened 5y ago
      > Mozilla laid off all their servo developers in 2020 Yeah, I know, that’s sad. > Why wouldn't it be possible? I don’t know if it’s possible in reality or not, but if I have to, I can imagine some reasons (I’m making them up): maybe it takes too long to write proper safe Rust, or maybe developers get stuck bikeshedding over use of language features, or maybe the language’s learning curve is too steep, or maybe compilation is too long for fast dev iterations, or maybe developers who like Rust don’t like large codebases, or maybe Rust does not provide any tangible benefits over already existing code, or any combination of reasons. Of course, you can write any program in any general-purpose language, just not everything is practical to be ever made. Like, I doubt people will make a full browser engine in Python, although it’s possible in theory.
dcow 5y ago
The advantage is actually pretty simple and I think this article overcomplicates it. The Rust community considers safety violations to be the language's fault not the implementer’s fault. In C++ if you violate the language spec then you’re and idiot who just blew their foot off. In Rust the people responsible for the project take it upon themselves to make sure that nobody blows their foot off. If you happen to cause UB in safe code, the community says “oops yeah we messed up how do we fix that”. This is a huge difference and the article alludes to it but I don't think the author states it clearly enough. Rust’s “hole problem” is that it forces developers to write safe code (conform to the language spec) up front which ultimately saves time and money. Developers are the audience and they want the best tools. Users want a hole (often as a means to an end, sure) and don’t care how it gets there; developers who make holes all day want the hole in the wall and not in their foot as frequently as possible.
- treekogreen 5y ago
  This is it right here, a similar analogy this brought up was car manufacturers of old making an excuse that fatalities were the idiot drivers fault and not because of the inherent lack of safety features of the vehicle. It's too damn easy to make the wrong assumption in C & C++ and spend a painful amount of time debugging. In my experience the added safety guarantees have made me more comfortable in "going faster" and back to vehicular terms the choice is still there to not fasten the seatbelt and go `unsafe`.
  - deleted 5y ago
    [deleted]
- littlestymaar 5y ago
  For the record, the author is the lead of the Rust compiler team.
  - dcow 5y ago
    Which we all appreciate. It doesn't mean the essay didn't turn out less articulate than it could be. It’s fair to critique writing regardless of the author’s credentials. The “hole” analogy is interesting but doesn't really serve to land a clear and coherent point as used by the author in my opinion.
jmull 5y ago
> The end value provided by Rust to its developers (and thus to their customers and employers) is less time arguing linguistic minutia and less time wrestling with a managed language environment, and more time focused on what actually matters to each of those developers (be it business logic, or family time). Hm, interesting that this boils down to a wholly unsupported claim. Part of it isn't even coherent to me. In my experience arguing linguistic minutia has nothing to do with programming languages (or any specific domain) and everything to do with personalities and social interactions. As for spending less time wrestling with the language environment, I suppose that very well may be true. But it may very well not be true. Here it's an assertion without anything backing it up. It certainly seems possible to me that another safe language (e.g., Javascript) may win in this area.
wly_cdgr 5y ago
The purpose of Rust is to provide a home for programmers who want to nurture a professional reputation for rigor but don't want to work in a boomer language
- wly_cdgr 5y ago
  Smh why are y'all so salty I'm just speaking facts. I'm not even saying it's a bad thing
- pjmlp 5y ago
  Modula-2, Ada and Object Pascal are quite nice boomer languages.
nsajko 5y ago
This is nonsense. In this context, safety is a term whose meaning is implied by Rust's design, i.e. it refers to code that's not unsafe. This doesn't translate to much of anything in the world outside of Rust, and it boggles my mind that so many HN comments use it as a mere buzz word, thus devaluing it.
sockpuppet69 5y ago
ashvardanian 5y ago
> People don’t want to buy a quarter-inch drill, they want a quarter-inch hole. Never heard that one before, will remember! Any more such phrases?
joshz404 5y ago
I just got into woodworking as a hobby to keep me active - physically and mentally. So, actually, I do actually want a rather nice drill. The hole it creates is a byproduct of mind, body and tool. And on safety, what I really want is a sawstop. I'm super super careful, but uh. I really really really don't want to lose my fingers and have them sewn back on. Safety is a really good quality to have, even if it's not idiot proof, even if I can lose my fingers in so many other ways with so many other tools. I want that little bit more, anything just about to not end up in the E.R.
drewm1980 5y ago
My observation is that there is a network effect happening with Rust due to the strict ownership model at API boundaries between libraries. You can call code in libraries without having to rely on your understanding of human-written documentation to get the data ownership right. I don't think the other nice properties of Rust can explain why it's going viral when so many other fast native languages in the C family haven't. Libraries being sound internally doesn't cause a network effect, but soundness at the interfaces between libraries does. The rust ecosystem goes extremely deep in transitive dependencies, and it's not just a tree; you have many libraries that get used by many other libraries, like serde, rayon, anyhow,... and it all still manages to compile and work together almost every single time you pull some random rust project off github. You can serialize almost anything in Rust because your library authors probably include serde support for their types... because ~their dependencies did. In C++ authors are more likely to be afraid to take on an additional dependency, and roll their own little serialization thing that only works within their library. I've seen the rust ecosystem getting locked into one widespread serialization library discussed as a problem, but it's a lot better than having zero widespread serialization libraries.

65 points by lukastyrychtr 5y ago

akagusu 5y ago

Rust is Pinky and Brain's attempts to take over the world.

danieleggert 5y ago
A hole in the ground.

ZeroGravitas 5y ago

Ways to figure out where the bug actually is when using systems built from different parts feels like an underexploited area. Many things in software actually play this role, from obvious thing like unit tests through to using popular software (if it works for everyone else then it's probably your bug). If no one else uses your exact Chipset/OS/language/compiler/library (version) matrix then the bug could be anywhere. I'm not sure it has an official academic name though. Modularity? Re-usability? Safety? Reliability? Predictability? Repeatability? Good ecosystem? There's a few things that overlap and combine.

PaulDavisThe1st 5y ago

This was interesting: > At this point, while reflecting on that topic, I decided to look more into the origins of the drill/hole adage; that diversion led me to a lovely post critiquing the adage, saying it “doesn’t go far enough.” The heart of the argument there is that people don’t want holes either. [... ] but then TFA didn't actually go there for Rust. After laying out a great example of how the purpose of a hole is ultimately about time (and possibly frustration), the author fails to reach a similar end-goal for Rust, despite hinting at it: > But, thinking of the drill/hole adage, I stopped and asked myself: “Who wants safety? Is it an end in itself? If it is merely a means to an end, then to what end?” What is the true end-goal? Saving lives/money/property by avoiding errors?

3pt14159 5y ago
I find it kinda amusing that the New York Times lead reporter on cybersecurity has a book out literally called "This is How They Tell Me the World Ends" and we're on the worlds premier hacker forum pondering about the point of safety in software languages.
- skybrian 5y ago
  Have you read it? Is it good? Maybe submit a link to a review?
- PaulDavisThe1st 5y ago
  You seem to be trying to make the point that is should be completely obvious what the point of safety is. And yet so much (not all, but a substantial part) of what that book is about has very little relationship to language safety. Rust will not protect you if there's a backdoor left in the system. Rust will not protect you if there's no password, or absurdly weak passwords. Rust will not protect you if your entire system design is predicated on a perimeter defense with no internal checks. Etc. etc. Now, I'm not so stupid as to believe that we shouldn't do all we can, and that can include language safety. But by itself, that doesn't have a lot to do with the huge end goal laid out in the book, which might be summarized as: be able to build computational systems and networks that are extremely resistant to unintended access, utilization and modification in pursuance of personal, political or national goals".
  - 3pt14159 5y ago
    > And yet so much (not all, but a substantial part) of what that book is about has very little relationship to language safety. Yes, yes. I know that. But we literally have a book floating around around THE END of the WORLD and us nerds can't justify even the first step around fixing these systems. It's like someone asking what good fire hydrants are since they won't help with battery fires.
- avgcorrection 5y ago
  I can’t believe people care about cybersecurity when climate change is a bigger threat to us all ad nauseam.

Supermancho 5y ago

Interestingly, what the adage left out, is the qualities. People don't just want a hole, without qualification. They want a hole that's reliably uniform (smooth bore, sharp edge), quick and easy to produce, and cost effective. If Rust can avoid more errors with nearly the same performance profile (and control) offered by C, it's an improvement. The Hole purpose is to be a better low level language.

smoe 5y ago
Also, there are people that want a hole and there are those, that are selling hole making to others. The latter would indeed want to buy the drill. A restaurant customer doesn't care what knife the chef used. But chefs still choose to get different specialized knifes for different tasks.
lanstin 5y ago
Is anyone writing a Python interpreter in Rust? Or an OpenSSL fork? Cert parsing libraries at least? I know there is a project to rewrite coreutils into Rust, seems that would also be a good demo. I don’t think the kernel drivers thing has landed yet, but it is also an interesting project.
- jcranmer 5y ago
  There's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime https://github.com/bytecodealliance/wasmtime There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/ https://briansmith.org/rustdoc/webpki/ There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challenging, and probably requires large amounts of assembly to guarantee correctness).
- pjmlp 5y ago
  While not Rust, there are definitely Python implementations in safe languages, namely Python itself, Java and .NET.

dcminter 5y ago

This is (to me) a very odd article. It creates some straw man definitions and points out that Rust doesn't hold up to them, and then gives a more accurate definition and complains that it isn't expansive enough. It concludes by pointing out that unsafe code is unsafe. Speaking personally, Rust offers a rather nice featureful syntax (and libraries), and saves me the trouble of worrying about certain kinds of very typical mistakes. I may want a hole, but a cordless drill with a comfortable hand grip is very likely my tool of choice. Especially thinking back to my father's corded underpowered temperamental drill with the easy to lose chuck key...

wussboy 5y ago
My dad always taped the chuck key to the drill's cord. Those were the days...
avgcorrection 5y ago
I was surprised to see that it was written by a Rust implementation insider. The first half is very meandering. Please just get to the point and leave footnotes and asterisks for things like “safe”. (Just my preference.)
cryptonector 5y ago
Moreover, at some point the rubber meets the road and some "unsafe" code almost certainly must exist at that point. The goal should not be to have zero lines of unsafe code, but to have so few that it is possible to review and understand them and to understand why, though they are "unsafe", they yield safe behavior. Rust does do this!
lamontcg 5y ago
> It concludes by pointing out that unsafe code is unsafe. It spent an awful lot of time on that without making very good points. About one paragraph of text could have pointed that reducing the surface area of unsafe code is therefore a good thing, which leads to "rewrite it in rust" which gets you more safe code. There also seemed to be a little bit of conflation of safe code with bug-free code which just isn't possible. Arguing English semantics of words which are being used to describe very specific compiler behavior is going to be a GIGO argument.

garethrowlands 5y ago

Surely the value proposition of Rust is fewer security vulnerabilities than an equivalent C program.

justbored123 5y ago
lamontcg 5y ago
And no garbage collector pauses or tuning.
- pjmlp 5y ago
  Pauses happens when using Rc types with a cascade deletion of deeply nested data structures, and if Drop are incorrectly written, even a possible stack overflow might occur.
  - zozbot234 5y ago
    > Pauses happens when using Rc types with a cascade deletion of deeply nested data structures True, but this is inherent to deterministic deallocation. Rust is getting local allocator support to make it easier to manage these tradeoffs. (Local allocators are commonly used already in C/C++.)
    - pjmlp 5y ago
      Only the call is deterministic, not how long it takes to return. Local allocators are also a thing in many languages with automatic memory management.
- garethrowlands 5y ago
  Well, if you just wanted no garbage collector, you could use C.

wrnr 5y ago

This article is focusses on the safety features of Rust the language but this is not something that many developers (or me at least) considered when adopting yet another language. For me I was looking todo computer graphics with something that wasn't c++ but had similar performance characteristics and could compile to WASM. Rust had the best language features for this and the most momentum behind it with things like wgpu and bevy. Fighting with the borrow checker and unsafe Rust is not something I do all day or every day, it is just something you live with.

aranchelk 5y ago

From the title, I was sure this was going to be an article about typed holes.

ibraheemdev 5y ago

For some context, this was written by Felix Klock, a lead of the Rust compiler team: https://github.com/pnkfelix https://github.com/pnkfelix

zozbot234 5y ago

The value proposition of Rust is that you can Rewrite Stuff in it and it's going to generally run faster, with fewer bugs, taking up less RAM and generating less heat in your processor. The rewriting part is the whole point - that's where all the fun is! I'm not sure why so many devs complain about being told to RIIR. Who doesn't want to be using state of the art tools when coding and developing their stuff? Software is eating the world anyway, so why can't Rust eat software?

beardedetim 5y ago
I don't want to get paid to write code. I want to get paid to solve problems. My least favorite type of problem to solve is "how do I explain ABC solution in Language 123". I hate it even more when ABC solution is working per any metric the business cares about.
verdagon 5y ago
I think greenfield projects in Rust make a lot of sense. However, for some existing projects, the math just doesn't check out. I worked on Google Earth for a few years, and the core was in C++. With ASan and modern C++, memory safety bugs rarely slipped into production... perhaps once every 3-4 months, and this was a million line codebase with 20 engineers working on it. When you consider the cost of a memory safety bug (some users get odd behavior), how rare they happen (because of our good test coverage), and that everything's sandboxed in WASM anyway, there's just not much cost to this kind of memory unsafety bug... and certainly not as much cost as a full rewrite. RIIR makes sense for projects whose memory unsafety causes catastrophic failure. And even then, in some of those cases it makes more sense to use Java or Javascript, which don't expose unsafe operations. RIIR makes sense if someone's doing something with extreme performance requirements, and they're okay with a tiny risk of memory unsafety (from unsafe code). All just my opinion though, I'm sure there are many other great opinions out there.
- derefr 5y ago
  > and that everything's sandboxed in WASM anyway, there's just not much cost to this kind of memory unsafety bug... Presumably, without the potential for memory-safety bugs, there'd be no need for anything like a WASM sandbox, no? If so, then can't the costs of the WASM sandbox (overhead, potential exploits in the JS/WASM runtime, etc.) be tallied under the column of "costs of memory-safety bugs"? In about the same sense that e.g. the costs associated with running a Web Application Firewall in front of a Wordpress instance, can be blamed on how vulnerable/exploitable Wordpress+PHP are as a stack. If you avoid introducing an attack-surface in the first place, then you don't need to spend effort on guarding it.

justbored123 5y ago

verdagon 5y ago

> If you are interested in helping solve any of these problems, please reach out! Coincidentally, we're working on these problems with Vale [0] by obviating the need for unsafe, while still having single ownership's performance benefits, by taking generational indices (a common Rust/C++ technique) and building them into the language itself, and by moving borrow checking to the region level instead of the object level [1]. Time will tell if it works out! [0] https://vale.dev/ https://vale.dev/ [1] https://verdagon.dev/blog/seamless-fearless-structured-concurrency https://verdagon.dev/blog/seamless-fearless-structured-concu...

zozbot234 5y ago
Many PL folks are now looking into ways to generalize Rust's borrow checking approach. Even the Rust community is getting into this kind of stuff with the GhostCell proposal and its many variations. It remains to be seen how such extensions and generalizations might be adopted in a way that's reasonably intuitive and ergonomic.

School-Cotton 5y ago

There is only one language (as far as I know) in the following niche: * compiles to native code with no GC or runtime overhead * Facilities for high-level abstraction well beyond those offered by C * Widely used in the mainstream. That language is C++. If Rust becomes mainstream, it will be the second language in that set. Thus, in my opinion, talking about the value proposition of Rust makes the most sense when comparing it to C++. I find it much easier to write and understand Rust than modern C++, and that’s what makes it valuable, for me.

dcow 5y ago
For me Rust and C++ have similar complexity in terms of learning curve and the main difference is where you spend your time. Rust programs have a tendency to work on the first or second try provided you can get them to compile. In C++ it’s easier to rig something up that technically meets the portion of the language spec that the compiler enforces, but who knows if it actually does what you expect and the debug cycle is much longer. Debugging is generally more frustrating and time consuming than simply conceptually massaging your implementation strategy until it fits Rust’s model, at least for me. Also Rust is pretty mainstream at this point.
ribit 5y ago
Pretty much that. Safety gimmick aside, Rust is (mostly) what C++ would have been if designed with modern knowledge of programming languages theory and compiler practice in mind. It’s not like Rust brings that much novel things to the table, it is has its roots in ML and friends that have been around for decades. It’s just that we didn’t know how to make ML-type languages fast in the 80-ties. So C++ designers did the best they could given the time period and the circumstances.
- nu11ptr 5y ago
  Are there other languages with compile time GC prior to Rust? I thought that was a pretty novel feature. I recall an ML variant with region inference, but that was just an optimization I believe for it's runtime GC. Edit: MLKit was the ML dialect I was thinking of - looked it up

k__ 5y ago

People make good money with renting out drills, so I'm not so sure about that analogy.

deleted 5y ago

[deleted]

lanstin 5y ago

I thought of this classic drill article: http://www.team.net/mjb/hawg.html http://www.team.net/mjb/hawg.html Not sure that is the Unix philosophy but definitely the attitude of many 90s C programmers. But also we want power and safety at the same time. A smart matter drill, if you will, that will dissolve when it hits flesh. Rust currently ushers a lot of thought about safety into the coding process, while with C you can start dangerously and then fix later with Valgrind/Purify etc. fun but bad results for OpenSSL or sudo or parsers in general.

ribit 5y ago

I think Rust’s hole purpose is to be an ergonomic language that supports modern practices and generates very fast executables. Safety is a nice thing to have, but that’s just an icing on the cake for folks who need it. For me at least, a proper type system, reasonable ownership model (slices and co), modular programming are worth much more than “safety”.

gameswithgo 5y ago

One small point I disagree with is characterizing using iteration to avoid bounds checks as "wrestling with your environment". At least for most developers, iterating instead of writing for loops by hand is the more natural approach, and I really like that Rust makes the way people WANT to write code the fastest path. Contrast with C# or Javascript where using iterators has performance overhead. So you have to ask yourself (in some domains) if the iterator is worth the overhead. In Rust you just use the iterator any time you can! However I can see how people coming from C might consider the for loop the more natural approach.

dhosek 5y ago
I saw a benchmark that indicated that the iterator approach was actually even faster than the loop.
pjmlp 5y ago
C# JIT can remove it, specially if PGO is enabled.

Dig1t 5y ago

Speaking by example: If you have one team of 10 people write a browser engine in C++ and another team of 10 people write the same browser engine in safe Rust (or as much safe rust as you can get away with), over a 5 year timespan you'll discover fewer UAF bugs in the Rust-written engine than the C++ one. This is the value prop for any company deciding to use Rust. Obviously every language comes with tradeoffs, but this is concretely what people mean when they throw around the word "safety". The author is also totally correct in pointing out how easy it is to include unsafe Rust in your code by linking unsafe crates. I think this should definitely be an area of discussion and awareness-raising on the part of developers.

zozbot234 5y ago
> I think this should definitely be an area of discussion and awareness-raising on the part of developers. It is. There is an unofficial `cargo geiger` tool that will alert you to these issues.
nlitened 5y ago
> If you have one team of 10 people write a browser engine in C++ and another team of 10 people write the same browser engine in safe Rust Has it ever been shown that it’s possible to write a full browser engine in Rust? I believe for C++ it has been proven multiple times. If I am not mistaken, Servo hasn’t been finished in 10 years.
- leshow 5y ago
  > Servo hasn’t been finished in 10 years. Mozilla laid off all their servo developers in 2020 > Has it ever been shown that it’s possible to write a full browser engine in Rust? Why wouldn't it be possible?
  - nlitened 5y ago
    > Mozilla laid off all their servo developers in 2020 Yeah, I know, that’s sad. > Why wouldn't it be possible? I don’t know if it’s possible in reality or not, but if I have to, I can imagine some reasons (I’m making them up): maybe it takes too long to write proper safe Rust, or maybe developers get stuck bikeshedding over use of language features, or maybe the language’s learning curve is too steep, or maybe compilation is too long for fast dev iterations, or maybe developers who like Rust don’t like large codebases, or maybe Rust does not provide any tangible benefits over already existing code, or any combination of reasons. Of course, you can write any program in any general-purpose language, just not everything is practical to be ever made. Like, I doubt people will make a full browser engine in Python, although it’s possible in theory.

dcow 5y ago

The advantage is actually pretty simple and I think this article overcomplicates it. The Rust community considers safety violations to be the language's fault not the implementer’s fault. In C++ if you violate the language spec then you’re and idiot who just blew their foot off. In Rust the people responsible for the project take it upon themselves to make sure that nobody blows their foot off. If you happen to cause UB in safe code, the community says “oops yeah we messed up how do we fix that”. This is a huge difference and the article alludes to it but I don't think the author states it clearly enough. Rust’s “hole problem” is that it forces developers to write safe code (conform to the language spec) up front which ultimately saves time and money. Developers are the audience and they want the best tools. Users want a hole (often as a means to an end, sure) and don’t care how it gets there; developers who make holes all day want the hole in the wall and not in their foot as frequently as possible.

treekogreen 5y ago
This is it right here, a similar analogy this brought up was car manufacturers of old making an excuse that fatalities were the idiot drivers fault and not because of the inherent lack of safety features of the vehicle. It's too damn easy to make the wrong assumption in C & C++ and spend a painful amount of time debugging. In my experience the added safety guarantees have made me more comfortable in "going faster" and back to vehicular terms the choice is still there to not fasten the seatbelt and go `unsafe`.
- deleted 5y ago
  [deleted]
littlestymaar 5y ago
For the record, the author is the lead of the Rust compiler team.
- dcow 5y ago
  Which we all appreciate. It doesn't mean the essay didn't turn out less articulate than it could be. It’s fair to critique writing regardless of the author’s credentials. The “hole” analogy is interesting but doesn't really serve to land a clear and coherent point as used by the author in my opinion.

jmull 5y ago

> The end value provided by Rust to its developers (and thus to their customers and employers) is less time arguing linguistic minutia and less time wrestling with a managed language environment, and more time focused on what actually matters to each of those developers (be it business logic, or family time). Hm, interesting that this boils down to a wholly unsupported claim. Part of it isn't even coherent to me. In my experience arguing linguistic minutia has nothing to do with programming languages (or any specific domain) and everything to do with personalities and social interactions. As for spending less time wrestling with the language environment, I suppose that very well may be true. But it may very well not be true. Here it's an assertion without anything backing it up. It certainly seems possible to me that another safe language (e.g., Javascript) may win in this area.

wly_cdgr 5y ago

The purpose of Rust is to provide a home for programmers who want to nurture a professional reputation for rigor but don't want to work in a boomer language

wly_cdgr 5y ago
Smh why are y'all so salty I'm just speaking facts. I'm not even saying it's a bad thing
pjmlp 5y ago
Modula-2, Ada and Object Pascal are quite nice boomer languages.

nsajko 5y ago

This is nonsense. In this context, safety is a term whose meaning is implied by Rust's design, i.e. it refers to code that's not unsafe. This doesn't translate to much of anything in the world outside of Rust, and it boggles my mind that so many HN comments use it as a mere buzz word, thus devaluing it.

sockpuppet69 5y ago

ashvardanian 5y ago

> People don’t want to buy a quarter-inch drill, they want a quarter-inch hole. Never heard that one before, will remember! Any more such phrases?

joshz404 5y ago

I just got into woodworking as a hobby to keep me active - physically and mentally. So, actually, I do actually want a rather nice drill. The hole it creates is a byproduct of mind, body and tool. And on safety, what I really want is a sawstop. I'm super super careful, but uh. I really really really don't want to lose my fingers and have them sewn back on. Safety is a really good quality to have, even if it's not idiot proof, even if I can lose my fingers in so many other ways with so many other tools. I want that little bit more, anything just about to not end up in the E.R.

drewm1980 5y ago

My observation is that there is a network effect happening with Rust due to the strict ownership model at API boundaries between libraries. You can call code in libraries without having to rely on your understanding of human-written documentation to get the data ownership right. I don't think the other nice properties of Rust can explain why it's going viral when so many other fast native languages in the C family haven't. Libraries being sound internally doesn't cause a network effect, but soundness at the interfaces between libraries does. The rust ecosystem goes extremely deep in transitive dependencies, and it's not just a tree; you have many libraries that get used by many other libraries, like serde, rayon, anyhow,... and it all still manages to compile and work together almost every single time you pull some random rust project off github. You can serialize almost anything in Rust because your library authors probably include serde support for their types... because ~their dependencies did. In C++ authors are more likely to be afraid to take on an additional dependency, and roll their own little serialization thing that only works within their library. I've seen the rust ecosystem getting locked into one widespread serialization library discussed as a problem, but it's a lot better than having zero widespread serialization libraries.