16 ms·

What it feels like when Rust saves your bacon

197 points by lukastyrychtr 4y ago

Animats 4y ago
"Each method is defined on this Context type that carries some common state, and the methods tend to call one another." This is classically a problem of GUI systems, where you have a large number of interlinked on-screen objects constantly undergoing modification.
- BiteCode_dev 4y ago
  And hence the general recommendation of having a single direction in your input/render cycle: - wait for input - a dispatcher take any input and turn it into a queue of model update actions - pop queue to perform latest model updates. - trigger a full tree rendering, passing the new model - start again So: - the model is a dumb static data structure - the dispatcher is the responsible for model updates and is a single entry point for the data flow - the UI and the model don't know about each other That what ELM, react and so on do now. Monodirectional MVC. It's hard to optimize the rendering though, but it's way easier to reason about when concurrency gets high.
  - mejutoco 4y ago
    > - trigger a full tree rendering, passing the new model I agree the Elm model makes it easy to reason about it. Just because we pass "the state of the world" each time instead of mutating it, does not mean that we need a full tree rendering. That is an implementation detail. We can update just the relevant part. If we think of it mostly as pure functions a lot of it is easier to memoize and — for same input — it is possible to return the same output straight away.
    - BiteCode_dev 4y ago
      That's what I mean by hard to optimize. Memoization is hard to get right, because if you compare only by value, it can be slow, but if you compare by identity, the cache can take a lot of memory. And of course, forcing a purely immutable model comes with its own unique challenges.
rob74 4y ago
Yes... but before you start feeling too sure about Rust protecting you from creating bugs, also consider this more cautionary (and very entertaining) tale posted on HN today: https://hacks.mozilla.org/2022/06/fuzzing-rust-minidump-for-embarrassment-and-crashes/ https://hacks.mozilla.org/2022/06/fuzzing-rust-minidump-for-...
- rq1 4y ago
  Well you’d have these bugs, plus the memory bugs in other languages.
  - fnord123 4y ago
    They already did. Hence the rewrite from C++ to Rust.
- proto_lambda 4y ago
  You mean the tale of someone rewriting a very complex and fiddly software from scratch, having it work great in production, and then using the ecosystem's great tooling to easily find and eliminate even more bugs than what the language already protected them from?
  - kjksf 4y ago
    The thing they rewrote also worked great in production. And fuzzing originated in C / C++ tools and is available for them as well, probably more diverse and mature than what is available in Rust. The point you did ignore was: Rust is being sold as magically making software safe and people selling that completely ignore the fact that logical bugs are also a thing. Which Rust evangelists find difficult to acknowledge because security is that one thing that Rust has going for it. So difficult that you would rather try to misdirect than to acknowledge that software written in Rust will crash. And when processing arbitrary user output, it'll crash badly when not written with care and fuzzed a lot. Kind of like C++.
    - proto_lambda 4y ago
shuger 4y ago
This article is super overcomplicated. All it had to say was that rust tells you when you keep reference to on stack variable after it goes out of scope. Context provided adds nothing. I must say - as someone who doesn't use rust - I haven't had this type of issue in years, and when I did it wasn't hard to debug. You get corrupted data, set data breakpoint and in the provided example you will see it being modified by unrelated operations on stack. From there there is only one conclusion. Authors reactions seems to be a bit exaggerated.
- renox 4y ago
  I agree with you on the first point, but I totally disagree with you on the second point: sure if you know how to reliably reproduce an issue it isn't complicated to debug, but this kind of issue can be difficult to reproduce, can create silent issues..
- atoav 4y ago
  It all depends on the complexity of your application. The type of guarantees Rust offers in my experience becomes exponentially more useful as your application grows in size.
  - lelanthran 4y ago
    > It all depends on the complexity of your application. The type of guarantees Rust offers in my experience becomes exponentially more useful as your application grows in size. Sure, but the development pattern that get used for larger applications typically don't benefit from Rust's additional safety; for one you're going to be using a garbage collected language.
    - MaulingMonkey 4y ago
      > for one you're going to be using a garbage collected language. I wish it were true, but promise you it is not. As a counterpoint, I point to most "AAA" gamedev and OS development. In gamedev it's even a bit flipped: The smaller indie gamedevs can pay the GC hit for Unity's C#, web JS, actionscript flash back in the day, etc. - not much working data, not much garbage. Larger scale titles start missing vsync and having horrible stuttering when GCs are thrown into the mix too brazenly - they're still used on smaller scales (embedding browser tech for UI, limited scope scripting, etc.) but they have a lot of native, non-GCed code.
Linda703 4y ago
[dead]
inox 4y ago
I was looking for some kind of story related to cooking bacon with Rust -> disappointed. Bacon is only used once - in the heading...
- proto_lambda 4y ago
  It's an idiom: https://en.wiktionary.org/wiki/save_someone%27s_bacon https://en.wiktionary.org/wiki/save_someone%27s_bacon
- antegamisou 4y ago
  Similarly expected a firmware write-up for an IoT BBQ.
lbriner 4y ago
I have only a small dabbling in Rust and it was to create a Postfix milter. What was awesome was that someone had already written a Rust crate so that I didn't have to do anything too horrific. The compiler on Ubuntu just worked as expected but, of course, as something that is not standalone, Rusts strong type-checking did not save me from writing something that didn't work. Part of the confusion is the very confusing (for a noob) difference between String and &str and as someone who has written C and C++, I don't have a problem with understanding references and addresses but I didn't find a very good explanation. This led me to writing code using the only way I could get it to compile that didn't crash at runtime (which was nice!) but it also didn't work. The second issue was that being something plugging into an external daemon, at the interface level, we were getting a raw pointer and had to convert it into a string to use it. I tried so many combinations but couldn't get it to work but thanks to the maintainer of the Rust crate (who obviously knew what he was doing) he told me where my code was wrong and I fixed it. So I guess good in that there were probably no horrific bugs, although this is much like C# or possibly Java. But yes, the strong checking doesn't stop things from not working.
labrador 4y ago
I've used Rust and I like it alright but it has the ugliest syntax of any major language since Perl
- proto_lambda 4y ago
  Have you seen modern C++? It has had new syntax bolted on every couple years for the past few decades, the result is quite phenomenal.
  - MauranKilom 4y ago
    Can you name what new syntax you abhor? I mean, other than []<>(){}() being a valid C++ expression [0], C++ hasn't even made any notable sygil-related syntax changes recently. Sure, some keywords were added (auto, constexpr, co_yield...) but I don't see how that leads to "ugly" syntax. [0]: That's a lambda capturing no state, having no template parameters, taking no arguments, with an empty body, finally being called immediately with no arguments. But half of that is optional. A more usual lambda would look like [foo](int bar) { return foo+bar; }.
    - mkl 4y ago
      Technically auto was already a keyword (from C) and was just repurposed. Pedantic but interesting. https://en.cppreference.com/w/c/keyword https://en.cppreference.com/w/c/keyword
    - woodruffw 4y ago
      I find the new user-defined literals syntax pretty ugly. Useful, but ugly. On the older side: the initialization list syntax has always been ugly (and bug-prone, due to the unintuitive evaluation order.)
    - ImprobableTruth 4y ago
      'requires requires' makes me cry
    - kingaillas 4y ago
dj_mc_merlin 4y ago
If only his webserver were written in Rust.
z3t4 4y ago
A garbage collector has saved my brain from overfrying many times.
darthrupert 4y ago
Rust's safety features have never been its main selling point for me. Modernity and (recently) momentum are. That it's impossible to author certain classes of bugs is a nice bonus. That said, I never want to see another rounding bug in financial statements that happened because some piece of code implicitly converted a string to a float and it kinda almost worked every time. To quote a cliche, I'm too old for that shit.
- darthrupert 4y ago
  (Probably float to string and back, actually. Some mess like that anyway)
axilmar 4y ago
Rust is undoubtedly a step forward in correctness, but boy, the article's code is so thick that for me, that I am a C++ programmer, is almost unreadable, especially for a quick reading... I skipped all the code and only read the text. I got to the point where it mentions that the language prevented them from storing a pointer to a stack object in a heap object, and that's really great, but boy oh boy, the code presented, and the error messages, where very difficult for me to grok even after the first few times... It seems to me that the more sophisticated the safety a language provides is the more complex its error messages/code are. It would be so nice if we could solve both problems at the same time...
- dijit 4y ago
  For whatever it’s worth: I think it’s harder to learn rust as a C++ programmer than it is for a new programmer. Reason being that you have to unlearn your paradigm before you’re able to learn the new paradigm; and it’s made slightly worse by giving the appearance of similarity (since certain concepts map directly, like flow control and loops).
  - proto_lambda 4y ago
    One big hurdle for C++ programmers learning Rust that I've seen time and time again in various community support channels is fixing their trust issues with the compiler. They are so used to compiler output being useless or worse than useless, they are unable to take advantage of rustc's stellar diagnostics (which frequently tell you exactly what you need to change to make things work) until they force themselves to actually read and internalise them. Once they realize that the tooling is actually working _with_ them, not _against_ them, they start to pick things up much quicker.
    - lionkor 4y ago
      In my experience only beginners have this issue, as a C++ programmer the compiler is my best friend.
    - scoutt 4y ago
rs_rs_rs_rs_rs 4y ago
munchler 4y ago
From the article: It’s pointing out that we are pushing into this vector which needs references into “the AST”, but we haven’t declared in our signature that the ast::Ty must actually from “the AST”. I think someone needs to write a typechecker for English to help out the author of this sentence.
PointyFluff 4y ago
If only rust caught blogging security errors. It's a terrible idea to post a photo of your child with her name on your public blog. It's one of those subtle security things that the rust compiler helps with; but not here, sadly.
FpUser 4y ago
So many words to describe a simple issue of using reference to out of scope data. Anyways I am using C++ a lot and this types of bugs are easily caught by analyzers or straight up by modern IDEs like CLion (you get a warning).
cobbzilla 4y ago
When I was first learning Rust, it was exactly this sort of lifetime issue that tripped me up and frustrated me, until I finally saw the light and understood how things work. Yes, the article is overly technical and detailed, but it captures very well the eureka moment of understanding Rust’s memory management. Some aspects are subtle yet profound. I am always happy to take a little more pain at code-writing and compile-time in exchange for more safety guarantees at run time; Rust is great in this regard.

197 points by lukastyrychtr 4y ago

"Each method is defined on this Context type that carries some common state, and the methods tend to call one another." This is classically a problem of GUI systems, where you have a large number of interlinked on-screen objects constantly undergoing modification.

BiteCode_dev 4y ago
And hence the general recommendation of having a single direction in your input/render cycle: - wait for input - a dispatcher take any input and turn it into a queue of model update actions - pop queue to perform latest model updates. - trigger a full tree rendering, passing the new model - start again So: - the model is a dumb static data structure - the dispatcher is the responsible for model updates and is a single entry point for the data flow - the UI and the model don't know about each other That what ELM, react and so on do now. Monodirectional MVC. It's hard to optimize the rendering though, but it's way easier to reason about when concurrency gets high.
- mejutoco 4y ago
  > - trigger a full tree rendering, passing the new model I agree the Elm model makes it easy to reason about it. Just because we pass "the state of the world" each time instead of mutating it, does not mean that we need a full tree rendering. That is an implementation detail. We can update just the relevant part. If we think of it mostly as pure functions a lot of it is easier to memoize and — for same input — it is possible to return the same output straight away.
  - BiteCode_dev 4y ago
    That's what I mean by hard to optimize. Memoization is hard to get right, because if you compare only by value, it can be slow, but if you compare by identity, the cache can take a lot of memory. And of course, forcing a purely immutable model comes with its own unique challenges.

rob74 4y ago

Yes... but before you start feeling too sure about Rust protecting you from creating bugs, also consider this more cautionary (and very entertaining) tale posted on HN today: https://hacks.mozilla.org/2022/06/fuzzing-rust-minidump-for-embarrassment-and-crashes/ https://hacks.mozilla.org/2022/06/fuzzing-rust-minidump-for-...

rq1 4y ago
Well you’d have these bugs, plus the memory bugs in other languages.
- fnord123 4y ago
  They already did. Hence the rewrite from C++ to Rust.
proto_lambda 4y ago
You mean the tale of someone rewriting a very complex and fiddly software from scratch, having it work great in production, and then using the ecosystem's great tooling to easily find and eliminate even more bugs than what the language already protected them from?
- kjksf 4y ago
  The thing they rewrote also worked great in production. And fuzzing originated in C / C++ tools and is available for them as well, probably more diverse and mature than what is available in Rust. The point you did ignore was: Rust is being sold as magically making software safe and people selling that completely ignore the fact that logical bugs are also a thing. Which Rust evangelists find difficult to acknowledge because security is that one thing that Rust has going for it. So difficult that you would rather try to misdirect than to acknowledge that software written in Rust will crash. And when processing arbitrary user output, it'll crash badly when not written with care and fuzzed a lot. Kind of like C++.
  - proto_lambda 4y ago

shuger 4y ago

This article is super overcomplicated. All it had to say was that rust tells you when you keep reference to on stack variable after it goes out of scope. Context provided adds nothing. I must say - as someone who doesn't use rust - I haven't had this type of issue in years, and when I did it wasn't hard to debug. You get corrupted data, set data breakpoint and in the provided example you will see it being modified by unrelated operations on stack. From there there is only one conclusion. Authors reactions seems to be a bit exaggerated.

renox 4y ago
I agree with you on the first point, but I totally disagree with you on the second point: sure if you know how to reliably reproduce an issue it isn't complicated to debug, but this kind of issue can be difficult to reproduce, can create silent issues..
atoav 4y ago
It all depends on the complexity of your application. The type of guarantees Rust offers in my experience becomes exponentially more useful as your application grows in size.
- lelanthran 4y ago
  > It all depends on the complexity of your application. The type of guarantees Rust offers in my experience becomes exponentially more useful as your application grows in size. Sure, but the development pattern that get used for larger applications typically don't benefit from Rust's additional safety; for one you're going to be using a garbage collected language.
  - MaulingMonkey 4y ago
    > for one you're going to be using a garbage collected language. I wish it were true, but promise you it is not. As a counterpoint, I point to most "AAA" gamedev and OS development. In gamedev it's even a bit flipped: The smaller indie gamedevs can pay the GC hit for Unity's C#, web JS, actionscript flash back in the day, etc. - not much working data, not much garbage. Larger scale titles start missing vsync and having horrible stuttering when GCs are thrown into the mix too brazenly - they're still used on smaller scales (embedding browser tech for UI, limited scope scripting, etc.) but they have a lot of native, non-GCed code.

Linda703 4y ago

[dead]

inox 4y ago

I was looking for some kind of story related to cooking bacon with Rust -> disappointed. Bacon is only used once - in the heading...

proto_lambda 4y ago
It's an idiom: https://en.wiktionary.org/wiki/save_someone%27s_bacon https://en.wiktionary.org/wiki/save_someone%27s_bacon
antegamisou 4y ago
Similarly expected a firmware write-up for an IoT BBQ.

lbriner 4y ago

I have only a small dabbling in Rust and it was to create a Postfix milter. What was awesome was that someone had already written a Rust crate so that I didn't have to do anything too horrific. The compiler on Ubuntu just worked as expected but, of course, as something that is not standalone, Rusts strong type-checking did not save me from writing something that didn't work. Part of the confusion is the very confusing (for a noob) difference between String and &str and as someone who has written C and C++, I don't have a problem with understanding references and addresses but I didn't find a very good explanation. This led me to writing code using the only way I could get it to compile that didn't crash at runtime (which was nice!) but it also didn't work. The second issue was that being something plugging into an external daemon, at the interface level, we were getting a raw pointer and had to convert it into a string to use it. I tried so many combinations but couldn't get it to work but thanks to the maintainer of the Rust crate (who obviously knew what he was doing) he told me where my code was wrong and I fixed it. So I guess good in that there were probably no horrific bugs, although this is much like C# or possibly Java. But yes, the strong checking doesn't stop things from not working.

labrador 4y ago

I've used Rust and I like it alright but it has the ugliest syntax of any major language since Perl

proto_lambda 4y ago
Have you seen modern C++? It has had new syntax bolted on every couple years for the past few decades, the result is quite phenomenal.
- MauranKilom 4y ago
  Can you name what new syntax you abhor? I mean, other than []<>(){}() being a valid C++ expression [0], C++ hasn't even made any notable sygil-related syntax changes recently. Sure, some keywords were added (auto, constexpr, co_yield...) but I don't see how that leads to "ugly" syntax. [0]: That's a lambda capturing no state, having no template parameters, taking no arguments, with an empty body, finally being called immediately with no arguments. But half of that is optional. A more usual lambda would look like [foo](int bar) { return foo+bar; }.
  - mkl 4y ago
    Technically auto was already a keyword (from C) and was just repurposed. Pedantic but interesting. https://en.cppreference.com/w/c/keyword https://en.cppreference.com/w/c/keyword
  - woodruffw 4y ago
    I find the new user-defined literals syntax pretty ugly. Useful, but ugly. On the older side: the initialization list syntax has always been ugly (and bug-prone, due to the unintuitive evaluation order.)
  - ImprobableTruth 4y ago
    'requires requires' makes me cry
  - kingaillas 4y ago

dj_mc_merlin 4y ago

If only his webserver were written in Rust.

z3t4 4y ago

A garbage collector has saved my brain from overfrying many times.

darthrupert 4y ago

Rust's safety features have never been its main selling point for me. Modernity and (recently) momentum are. That it's impossible to author certain classes of bugs is a nice bonus. That said, I never want to see another rounding bug in financial statements that happened because some piece of code implicitly converted a string to a float and it kinda almost worked every time. To quote a cliche, I'm too old for that shit.

darthrupert 4y ago
(Probably float to string and back, actually. Some mess like that anyway)

axilmar 4y ago

Rust is undoubtedly a step forward in correctness, but boy, the article's code is so thick that for me, that I am a C++ programmer, is almost unreadable, especially for a quick reading... I skipped all the code and only read the text. I got to the point where it mentions that the language prevented them from storing a pointer to a stack object in a heap object, and that's really great, but boy oh boy, the code presented, and the error messages, where very difficult for me to grok even after the first few times... It seems to me that the more sophisticated the safety a language provides is the more complex its error messages/code are. It would be so nice if we could solve both problems at the same time...

dijit 4y ago
For whatever it’s worth: I think it’s harder to learn rust as a C++ programmer than it is for a new programmer. Reason being that you have to unlearn your paradigm before you’re able to learn the new paradigm; and it’s made slightly worse by giving the appearance of similarity (since certain concepts map directly, like flow control and loops).
- proto_lambda 4y ago
  One big hurdle for C++ programmers learning Rust that I've seen time and time again in various community support channels is fixing their trust issues with the compiler. They are so used to compiler output being useless or worse than useless, they are unable to take advantage of rustc's stellar diagnostics (which frequently tell you exactly what you need to change to make things work) until they force themselves to actually read and internalise them. Once they realize that the tooling is actually working _with_ them, not _against_ them, they start to pick things up much quicker.
  - lionkor 4y ago
    In my experience only beginners have this issue, as a C++ programmer the compiler is my best friend.
  - scoutt 4y ago

rs_rs_rs_rs_rs 4y ago

munchler 4y ago

From the article: It’s pointing out that we are pushing into this vector which needs references into “the AST”, but we haven’t declared in our signature that the ast::Ty must actually from “the AST”. I think someone needs to write a typechecker for English to help out the author of this sentence.

PointyFluff 4y ago

If only rust caught blogging security errors. It's a terrible idea to post a photo of your child with her name on your public blog. It's one of those subtle security things that the rust compiler helps with; but not here, sadly.

FpUser 4y ago

So many words to describe a simple issue of using reference to out of scope data. Anyways I am using C++ a lot and this types of bugs are easily caught by analyzers or straight up by modern IDEs like CLion (you get a warning).

cobbzilla 4y ago

When I was first learning Rust, it was exactly this sort of lifetime issue that tripped me up and frustrated me, until I finally saw the light and understood how things work. Yes, the article is overly technical and detailed, but it captures very well the eureka moment of understanding Rust’s memory management. Some aspects are subtle yet profound. I am always happy to take a little more pain at code-writing and compile-time in exchange for more safety guarantees at run time; Rust is great in this regard.