4 ms·

Rust is not a “safe language”

21 points by longrod 4y ago

Communitivity 4y ago
While correct, the headline is a bit disingenuous and the content is kind of obvious. No systems language will ever be 100% safe, and Rust is not the exception, as Safe is a spectrum, as Andrew Kelley points out [1]. However, Kelly also points out that Rust tends toward safety. Different languages tend toward safety at different rates, and Rust tends toward safety at a high rate for many reasons. In my experience Rust is the safest language that still allows me to accomplish the professional development tasks I do. [1] https://twitter.com/andy_kelley/status/1554933549999894528 https://twitter.com/andy_kelley/status/1554933549999894528
- rurban 4y ago
  Of course there did exist 100% safe system languages. Even concurrency safe. Plenty of them.
  - pjmlp 4y ago
    Even NEWP, still being used today on the ClearPath high security mainframes has an unsafe escape hatch. Note that Burroughs doesn't support Assembly, all low level hardware capabilities are exposed as compiler intrisics.
- tengwar2 4y ago
  I don't think that this is restricted to systems languages. Any language where you can do something like extend a linked list indefinitely seems to have the potential for "unsafe" problems such as memory exhaustion.
elteto 4y ago
This title is pure clickbait. It's a cherrypicked line taken out of context. For reference, this is the tweet in it's entirety: "I agree with this person, along with many Rust community members. Rust is not a "safe language". It's a language that strongly encourages safety. Safety is a spectrum. The people saying that safety is all or nothing are toxic and Rust community needs to stop turning a blind eye."
jmillikin 4y ago
Is there a word for the type of verbal shell game where a purposefully-ambiguous phrase is used to imply an indefensible position? For example, the old joke about functional vs "non-functional" languages. In one sense, saying "X is not a safe language" could mean that X is not a language that exclusively allows proven-safe constructions. One might say that Rust is not a safe language because it has `unsafe`, or Ada is not a safe language because SPARK isn't mandatory. But this isn't what a typical reader should be expected to understand from the quoted phrase -- to say that Rust is "not safe" is to say that it is unsafe. It feels unreasonable to claim Rust is "not safe" when the same accusation would never credibly be leveled at Go, Java, C#, or other languages that encourage (without mandating) memory-safe programming. -- > The people saying that safety is all or nothing are toxic and > Rust community needs to stop turning a blind eye. There is no such thing as a "Rust community". There cannot be a community for a programming language when (1) there's no way to prevent someone from using that language, and (2) the barrier to entry is an HTTP download and 15-minute tutorial. I never hear about people discussing the "C++ community", or writing on Twitter about how the "Java community" needs to do something or other. It wouldn't fly, there's too many people known to use those languages to ascribe a common motivation to them. Yet when there's a smaller language -- Rust, Haskell, Go, Zig, whatever -- suddenly people start treating them as if they are a group, and criticizing people who use Rust for the behavior of other people who (claim to) use Rust. It's madness. At best there can be a "posters on Reddit's /r/rust subforum" community, or "posters on Twitter's #rust hashtag community", but these are even more dubious. The only requirement to be a member of these "communities" is an email address and enough sense to not get banned. Nobody would say "the Twitter #rust hashtag community needs to ..." because it would be obviously silly to expect good behavior from freshly registered user "PmMeToePhotos123456".
- cwillu 4y ago
  https://en.wikipedia.org/wiki/Motte-and-bailey_fallacy https://en.wikipedia.org/wiki/Motte-and-bailey_fallacy
- hitekker 4y ago
  > There is no such thing as a "Rust community". Actually, there is: https://www.rust-lang.org/community https://www.rust-lang.org/community. It's centralized and they even have appointed moderators https://www.rust-lang.org/governance/teams/moderation https://www.rust-lang.org/governance/teams/moderation. A bunch of them resigned recently due to alleged toxicity in the rust community and governance. https://www.theregister.com/2021/11/23/rust_moderation_team_quits/ https://www.theregister.com/2021/11/23/rust_moderation_team_.... Rust's community structure, and its accountability for its members misbehavior, runs counter to other programming languages like Zig https://kristoff.it/blog/interfacing-with-zig/ https://kristoff.it/blog/interfacing-with-zig/ which explicitly claims to be decentralized.
pjmlp 4y ago
Of course any systems programming language needs an unsafe escape hatch, if nothing else the ability to link into Assembly code, and then the pandora box is open. The big difference is how much regular application developers are forced to go down that path, outside writing drivers or kernel stuff. Zig should focus its security story in being better than just a Modula-2 (1978) with C inspired syntax.
exabrial 4y ago
I agree with "Safety is a spectrum". By all accounts, Java is a "safe language"... until your code uses sun.misc.Unsafe
- pjmlp 4y ago
  Or JNI, Panama,...
  - exabrial 4y ago
    Does JNI allow native code to make changes to JVM heap? I thought everything in JNI was copied in/out
    - pjmlp 4y ago
      Not directly, only via conversion of handles into references/buffers, however once you call into external native code all bets are open. Most of the time a Java application core dumps most likely there is a native method on the call stack close to the crash point.
pkrumins 4y ago
Actually Rust is a syntax error. It passes the duck test for a syntax error - it looks like a syntax error, it acts like a syntax error, and it prints a syntax error, so it is a syntax error.
midislack 4y ago
RIDF roundup: the thread. Hit us with your best Rust activism!
pornel 4y ago
The reddit quote (image, sigh) is right: in Rust `unsafe` has its place. The language has been designed with the escape hatch from the start, so the "safe" subset of Rust is not a complete language. Rust wouldn't get far as a systems programming language if it always had to face limits of the borrow checking model and require the mythical Sufficiently Smart Compiler to magically fix every performance overhead. Rust still helps ensuring that the "hold my beer" blocks are correct by reducing their scope to a few clearly marked places. This helps focus code reviews and fuzzing. Rust also encourages wrapping of high-risk code in foolproof abstractions, and has universal rules for how tight and robust such abstraction has to be. In a way, Python or Java are also safe abstractions on top of "unsafe" CPython or HotSpot. In Rust this division is just more granular, with the same syntax on both sides. It's worth remembering that in Rust "safe" refers to Rust's specific guarantees around memory safety and thread safety, but the field of software security is much larger than that. There are lots of possible logic bugs and security issues beyond that, and Rust won't stop you from running `remove_dir_all("/")`.

21 points by longrod 4y ago

While correct, the headline is a bit disingenuous and the content is kind of obvious. No systems language will ever be 100% safe, and Rust is not the exception, as Safe is a spectrum, as Andrew Kelley points out [1]. However, Kelly also points out that Rust tends toward safety. Different languages tend toward safety at different rates, and Rust tends toward safety at a high rate for many reasons. In my experience Rust is the safest language that still allows me to accomplish the professional development tasks I do. [1] https://twitter.com/andy_kelley/status/1554933549999894528 https://twitter.com/andy_kelley/status/1554933549999894528

rurban 4y ago
Of course there did exist 100% safe system languages. Even concurrency safe. Plenty of them.
- pjmlp 4y ago
  Even NEWP, still being used today on the ClearPath high security mainframes has an unsafe escape hatch. Note that Burroughs doesn't support Assembly, all low level hardware capabilities are exposed as compiler intrisics.
tengwar2 4y ago
I don't think that this is restricted to systems languages. Any language where you can do something like extend a linked list indefinitely seems to have the potential for "unsafe" problems such as memory exhaustion.

elteto 4y ago

This title is pure clickbait. It's a cherrypicked line taken out of context. For reference, this is the tweet in it's entirety: "I agree with this person, along with many Rust community members. Rust is not a "safe language". It's a language that strongly encourages safety. Safety is a spectrum. The people saying that safety is all or nothing are toxic and Rust community needs to stop turning a blind eye."

jmillikin 4y ago

Is there a word for the type of verbal shell game where a purposefully-ambiguous phrase is used to imply an indefensible position? For example, the old joke about functional vs "non-functional" languages. In one sense, saying "X is not a safe language" could mean that X is not a language that exclusively allows proven-safe constructions. One might say that Rust is not a safe language because it has `unsafe`, or Ada is not a safe language because SPARK isn't mandatory. But this isn't what a typical reader should be expected to understand from the quoted phrase -- to say that Rust is "not safe" is to say that it is unsafe. It feels unreasonable to claim Rust is "not safe" when the same accusation would never credibly be leveled at Go, Java, C#, or other languages that encourage (without mandating) memory-safe programming. -- > The people saying that safety is all or nothing are toxic and > Rust community needs to stop turning a blind eye. There is no such thing as a "Rust community". There cannot be a community for a programming language when (1) there's no way to prevent someone from using that language, and (2) the barrier to entry is an HTTP download and 15-minute tutorial. I never hear about people discussing the "C++ community", or writing on Twitter about how the "Java community" needs to do something or other. It wouldn't fly, there's too many people known to use those languages to ascribe a common motivation to them. Yet when there's a smaller language -- Rust, Haskell, Go, Zig, whatever -- suddenly people start treating them as if they are a group, and criticizing people who use Rust for the behavior of other people who (claim to) use Rust. It's madness. At best there can be a "posters on Reddit's /r/rust subforum" community, or "posters on Twitter's #rust hashtag community", but these are even more dubious. The only requirement to be a member of these "communities" is an email address and enough sense to not get banned. Nobody would say "the Twitter #rust hashtag community needs to ..." because it would be obviously silly to expect good behavior from freshly registered user "PmMeToePhotos123456".

cwillu 4y ago
https://en.wikipedia.org/wiki/Motte-and-bailey_fallacy https://en.wikipedia.org/wiki/Motte-and-bailey_fallacy
hitekker 4y ago
> There is no such thing as a "Rust community". Actually, there is: https://www.rust-lang.org/community https://www.rust-lang.org/community. It's centralized and they even have appointed moderators https://www.rust-lang.org/governance/teams/moderation https://www.rust-lang.org/governance/teams/moderation. A bunch of them resigned recently due to alleged toxicity in the rust community and governance. https://www.theregister.com/2021/11/23/rust_moderation_team_quits/ https://www.theregister.com/2021/11/23/rust_moderation_team_.... Rust's community structure, and its accountability for its members misbehavior, runs counter to other programming languages like Zig https://kristoff.it/blog/interfacing-with-zig/ https://kristoff.it/blog/interfacing-with-zig/ which explicitly claims to be decentralized.

pjmlp 4y ago

Of course any systems programming language needs an unsafe escape hatch, if nothing else the ability to link into Assembly code, and then the pandora box is open. The big difference is how much regular application developers are forced to go down that path, outside writing drivers or kernel stuff. Zig should focus its security story in being better than just a Modula-2 (1978) with C inspired syntax.

exabrial 4y ago

I agree with "Safety is a spectrum". By all accounts, Java is a "safe language"... until your code uses sun.misc.Unsafe

pjmlp 4y ago
Or JNI, Panama,...
- exabrial 4y ago
  Does JNI allow native code to make changes to JVM heap? I thought everything in JNI was copied in/out
  - pjmlp 4y ago
    Not directly, only via conversion of handles into references/buffers, however once you call into external native code all bets are open. Most of the time a Java application core dumps most likely there is a native method on the call stack close to the crash point.

pkrumins 4y ago

Actually Rust is a syntax error. It passes the duck test for a syntax error - it looks like a syntax error, it acts like a syntax error, and it prints a syntax error, so it is a syntax error.

midislack 4y ago

RIDF roundup: the thread. Hit us with your best Rust activism!

pornel 4y ago

The reddit quote (image, sigh) is right: in Rust `unsafe` has its place. The language has been designed with the escape hatch from the start, so the "safe" subset of Rust is not a complete language. Rust wouldn't get far as a systems programming language if it always had to face limits of the borrow checking model and require the mythical Sufficiently Smart Compiler to magically fix every performance overhead. Rust still helps ensuring that the "hold my beer" blocks are correct by reducing their scope to a few clearly marked places. This helps focus code reviews and fuzzing. Rust also encourages wrapping of high-risk code in foolproof abstractions, and has universal rules for how tight and robust such abstraction has to be. In a way, Python or Java are also safe abstractions on top of "unsafe" CPython or HotSpot. In Rust this division is just more granular, with the same syntax on both sides. It's worth remembering that in Rust "safe" refers to Rust's specific guarantees around memory safety and thread safety, but the field of software security is much larger than that. There are lots of possible logic bugs and security issues beyond that, and Rust won't stop you from running `remove_dir_all("/")`.