4 ms·

As far as I am concerned, the alleged "memory safety" benefits of Rust do not have much more value or weight than wishful thinking, this kind of claim can only

As far as I am concerned, the alleged "memory safety" benefits of Rust do not have much more value or weight than wishful thinking, this kind of claim can only gain strength by standing the test of time. Computer security is a real problem that must be fully addressed at every step of the design of a system, language and tooling can help, a bit, not much. Rust is not a "safe" language. It might be -safer- than C/C++, but only time will tell if the difference is significant.

hsn915 4y ago
Here's a hypothesis I'd like to see Rust advocate attack: In any serious system written in Rust, significant portions of it will have to be written in "Unsafe Rust".
- dtolnay 4y ago
  https://github.com/diem/diem https://github.com/diem/diem is 387,952 lines of Rust code across 169 crates. In total there are 3 lines of unsafe code, which is less then 0.001% (1 thousandth of 1%).
  - deleted 4y ago
    [deleted]
  - hitekker 4y ago
    > The launch was originally planned to be in 2020 but only rudimentary experimental code has been released until the project was abandoned in January 2022. https://en.wikipedia.org/wiki/Diem_(digital_currency) https://en.wikipedia.org/wiki/Diem_(digital_currency)
- steveklabnik 4y ago
  You’d have to demonstrate that this is the case before it’d be worthy of “attacking.” You’d also have to define “serious system” and “significant portion” and if you really do mean “any,” that is, is a single counter example enough, and if not, what percentage of them would need to be so for this to be true. You’d also have to say what’s in bound or not, is it just the code you wrote for the system, is it any dependencies, etc etc etc. Does “significant” mean “large amount” or does it mean “most important”?
- hansvm 4y ago
  I prefer Zig for a lot of things, but I use Rust for $WORK, and I'll toss something out: GhostCell is an interesting venture away from that idea. For the sorts of loopy data structures that upset the compiler, GhostCell provides a small, well-vetted, probably correct unsafe core and a safe API for accessing it that greatly reduces the amount of unsafe one should need. The core mechanism is just a higher order phantom (ghost) type parameter that gives the compiler enough information to vet that the thing you're handling was acquired properly. The community has generally been pretty gung-ho about getting the most safe bang for your unsafe buck, and the compiler has enough bells and whistles to make many such ideas pretty seamless.

hsn915 4y ago

Here's a hypothesis I'd like to see Rust advocate attack: In any serious system written in Rust, significant portions of it will have to be written in "Unsafe Rust".

dtolnay 4y ago
https://github.com/diem/diem https://github.com/diem/diem is 387,952 lines of Rust code across 169 crates. In total there are 3 lines of unsafe code, which is less then 0.001% (1 thousandth of 1%).
- deleted 4y ago
  [deleted]
- hitekker 4y ago
  > The launch was originally planned to be in 2020 but only rudimentary experimental code has been released until the project was abandoned in January 2022. https://en.wikipedia.org/wiki/Diem_(digital_currency) https://en.wikipedia.org/wiki/Diem_(digital_currency)
steveklabnik 4y ago
You’d have to demonstrate that this is the case before it’d be worthy of “attacking.” You’d also have to define “serious system” and “significant portion” and if you really do mean “any,” that is, is a single counter example enough, and if not, what percentage of them would need to be so for this to be true. You’d also have to say what’s in bound or not, is it just the code you wrote for the system, is it any dependencies, etc etc etc. Does “significant” mean “large amount” or does it mean “most important”?
hansvm 4y ago
I prefer Zig for a lot of things, but I use Rust for $WORK, and I'll toss something out: GhostCell is an interesting venture away from that idea. For the sorts of loopy data structures that upset the compiler, GhostCell provides a small, well-vetted, probably correct unsafe core and a safe API for accessing it that greatly reduces the amount of unsafe one should need. The core mechanism is just a higher order phantom (ghost) type parameter that gives the compiler enough information to vet that the thing you're handling was acquired properly. The community has generally been pretty gung-ho about getting the most safe bang for your unsafe buck, and the compiler has enough bells and whistles to make many such ideas pretty seamless.