3 ms·

"unsafe forbidden" (GH tag) Is this practical for web programming? In the domains I'm used to (embedded and graphics programming), this isn't feasible. I recal

• 0x457 4y ago
  Most frameworks in rust a like Sinatra and Flask. There aren't any Rails level frameworks. I don't think there are any Rails level frameworks besides Django and a few JVM frameworks. Rust web frameworks just give you tools to get from request to response, the rest is up to you. I think that is fine, yeah it leads to some boilerplate to wire up a few libraries together, but you did it once, and you're done.
  • theironhammer 4y ago
    There's this: https://rust-on-nails.com https://rust-on-nails.com
    • 0x457 4y ago
      Yes, anyone can call `X on Rails`, but look at the first example here: https://rust-on-nails.com/docs/full-stack-web/web-server/ https://rust-on-nails.com/docs/full-stack-web/web-server/ Does it look like anything close to Ruby on Rails in terms of tooling? No, because Rust on Nails doesn't provide any tools at all. It literally doesn't take care of anything, but provides some (questionable) decisions made for you. You know what I've never done in RoR? This: use std::env; use std::str::FromStr; #[derive(Clone, Debug)] pub struct Config { pub database_url: String, } impl Config { pub fn new() -> Config { let database_url = env::var("DATABASE_URL").expect("DATABASE_URL not set"); Config { database_url, } } pub fn create_pool(&self) -> deadpool_postgres::Pool { let config = tokio_postgres::Config::from_str(&self.database_url).unwrap(); let manager = if self.database_url.contains("sslmode=require") { let mut root_store = rustls::RootCertStore::empty(); root_store.add_server_trust_anchors( webpki_roots::TLS_SERVER_ROOTS .0 .iter() .map(|ta| { rustls::OwnedTrustAnchor::from_subject_spki_name_constraints( ta.subject, ta.spki, ta.name_constraints, ) }) ); let tls_config = rustls::ClientConfig::builder() .with_safe_defaults() .with_root_certificates(root_store) .with_no_client_auth(); let tls = tokio_postgres_rustls::MakeRustlsConnect::new(tls_config); deadpool_postgres::Manager::new(config, tls) } else { deadpool_postgres::Manager::new(config, tokio_postgres::NoTls) }; deadpool_postgres::Pool::builder(manager).build().unwrap() } }
• lovingCranberry 4y ago
  > "unsafe forbidden" (GH tag) Unrelated to this project, but I dislike the obsession of "unsafe" within the rust community. Sometimes I need to dereference a raw pointer (rare!). Sometimes I actually know what I'm doing (very rare!!). Sometimes I rigorously tested my code (exceptionally rare!!!). When I see people making PRs (to e.g. Actix) to change unsafe code to safe code in an API the user *never* sees, which results in a performance penalty, just for the sake of not using the word "unsafe" in the code, I get mad. I totally understood Nikolay's reaction back then. Random people opened PRs and flamed him without knowing anything about the internals and the consequences. The unsafe keyword means that I know what I'm doing. Just trust me for once, please. Edit: if you actually want to know what you're doing too, I recommend you writing some linked lists. I hate linked lists with passion, I think they are a bad data structure and you should use Vectors 90% of the time and VecDeque the other 10% of cases. But they help you to understand what you're spending your electricity on.
  • huimang 4y ago
    What does it matter if a user never interacts with that API or not? Rust is focused around -safety- and performance. I would rather have a slight performance hit and safe code, rather than trusting some random person to 100% correctly write unsafe code. Which is why tools like cargo-audit and cargo-geiger exist. IIRC Nikolay didn't communicate well about -why- unsafe was used, and just closed PRs that converted unsafe code to safe code. > The unsafe keyword means that I know what I'm doing. Just trust me for once, please. No, it means you think you know what you're doing. It's more likely that you don't know what you're doing and/or are unnecessarily invoking unsafe for convenience, than the opposite. Theoretically I can look at your code and see if it's correct... or I could just use projects that don't use unsafe at all and save the time/headache. When it comes to web server frameworks and security, I would like to see as little unsafe usage as possible, and documentation as to exactly why it's needed. Which is why people switched to Warp/Tower and now Axum which forbids unsafe code entirely. If all I cared about were eking out all performance at the cost of safety, I wouldn't be using Rust in the first place.
    • the__alchemist 4y ago