3 ms·
I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.
by benreesman 5y ago
I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.
- Closi 5y agoWhy compare 'non-tight' Rust against 'tight' C? Surely we should compare tight Rust (with some 'tight' unsafe sections) against tight C?
- benreesman 5y agoI must be more tired than I thought if I said “non-tight Rust” and forgot ten minutes later. I just think if mistakes need to be literally low as possible you’ve got a better bet than Rust unsafe. The language spec is smaller, the static analyzers have been getting tuned for decades, and the project leaders arent kinda hostile to people using it in the first place.
- nyanpasu64 5y agoI think it's easier to write correct safe Rust than C, I wouldn't say it's easier to write correct Rust with unsafe blocks than C (many operations strip provenance, you can't free a &UnsafeCell<T> created from a Box<T>, you can't mix &mut and const but you might be able to mix Vec<T> and const (https://github.com/rust-lang/unsafe-code-guidelines/issues/262 https://github.com/rust-lang/unsafe-code-guidelines/issues/2...), self-referential &mut or Pin<&mut> is likely unsound but undetermined), and it's absolutely more difficult to write sound unsafe Rust than C (sound unsafe Rust must make it impossible for callers to induce UB through any possible set of safe operations including interior mutability, logically inconsistent inputs, and panics).
- LasEspuelas 5y agoWhat is "tight ANSI C"?
- qualudeheart 5y agoWe could set up a prediction market for this. A study would be performed of attempts ti pentest randomly selected unsafe Rust and tight ANSI C programs. A prediction market used to estimate the probability of either language winning before publication of results. Someone needs to make this a thing.