11 ms·

Zig is not memory-safe (without quarantining allocations forever which is insufficient for production). Rust is. This is an enormous difference which affects ev

Zig is not memory-safe (without quarantining allocations forever which is insufficient for production). Rust is. This is an enormous difference which affects everything about these languages. For example, the "gentler learning curve" in Zig is precisely a result of not being memory safe.

azakai 4y ago
> quarantining allocations forever [..] is insufficient for production In most cases that's true, but not all. ARM MTE + quarantine has just 1-2% overhead as tested on Chrome: https://security.googleblog.com/2022/05/retrofitting-temporal-memory-safety-on-c.html https://security.googleblog.com/2022/05/retrofitting-tempora... Perhaps we'll see such techniques used in newer languages like Zig. (This doesn't detract from your main point, of course - yes, Zig is simpler because it has less safety.)
- pcwalton 4y ago
  The approach described there is significantly different from Zig's approach, which doesn't use MTE and quarantines forever. Note that Chromium never seriously considered quarantining forever as Zig does because leaking every allocation less than 4kB unless all allocations in that page are freed is not production viable.
  - azakai 4y ago
    True, but I don't think Zig is committed to that particular idea and nothing else. Yeah, quarantining forever is going to have much more memory overhead. It might be fine for some use cases, but not a browser or anything else complex + long-running, I agree.
Shadonototra 4y ago
it is a strength, and the reason why i picked Zig over Rust i want to control lifetimes and memory management, so i can target the hardware i want, and i can play with memory the way i want to do tricks and optimizations that could not be possible with a rigid language like rust(that is very slow btw) the day zig adds borrowchecker or some lifetime enforcment shenanigan will be the day i'll look for an alternative
vegai_ 4y ago
It's more memory-safe than C, which is being used in production in billions of places right now.

azakai 4y ago

> quarantining allocations forever [..] is insufficient for production In most cases that's true, but not all. ARM MTE + quarantine has just 1-2% overhead as tested on Chrome: https://security.googleblog.com/2022/05/retrofitting-temporal-memory-safety-on-c.html https://security.googleblog.com/2022/05/retrofitting-tempora... Perhaps we'll see such techniques used in newer languages like Zig. (This doesn't detract from your main point, of course - yes, Zig is simpler because it has less safety.)

pcwalton 4y ago
The approach described there is significantly different from Zig's approach, which doesn't use MTE and quarantines forever. Note that Chromium never seriously considered quarantining forever as Zig does because leaking every allocation less than 4kB unless all allocations in that page are freed is not production viable.
- azakai 4y ago
  True, but I don't think Zig is committed to that particular idea and nothing else. Yeah, quarantining forever is going to have much more memory overhead. It might be fine for some use cases, but not a browser or anything else complex + long-running, I agree.

Shadonototra 4y ago

it is a strength, and the reason why i picked Zig over Rust i want to control lifetimes and memory management, so i can target the hardware i want, and i can play with memory the way i want to do tricks and optimizations that could not be possible with a rigid language like rust(that is very slow btw) the day zig adds borrowchecker or some lifetime enforcment shenanigan will be the day i'll look for an alternative

vegai_ 4y ago

It's more memory-safe than C, which is being used in production in billions of places right now.