5 ms·

I think a distinction can be made in that you never really need to use unsafe operations in python or Java. In rust, you need unsafe. Just about every data stru

I think a distinction can be made in that you never really need to use unsafe operations in python or Java. In rust, you need unsafe. Just about every data structure in the stdlib uses unsafe. I think it's fair to call Rust a memory safe language. But I don't think it's on the same tier as a fully managed language like python.

burntsushi 4y ago
I suppose reasonable people can disagree, but I don't think it's anywhere near as clear cut as you seem to be implying. You talk about data structures in std using unsafe, but you don't mention the heaps and piles of C code used to implement CPython's standard library. It's not like you need `unsafe` in Rust to build every data structure. I build oodles of data structures on top of the fundamental primitives provided by std without using any `unsafe` explicitly whatsoever. And it is not at all uncommon to write application code in Rust that doesn't utter `unsafe` at all. Even ripgrep has almost none of it. At the "application" level it has exactly two uses: one related to PCRE2 shenanigans and one related to the use of file backed memory maps. Both of those things are optional. Then there's another whole perspective here, which is that if you're using Rust in the first place, there's a non-trivial chance you're working on something "low level" that might require `unsafe`. Where as with Python you probably aren't doing "low level" work and just don't care much about perf within certain contexts. That has less (albeit not "nothing") to do with the design of the languages and more to do with the problems you're trying to solve. To be clear, I am not saying you're definitely wrong. But as someone who has written many tens of thousands of lines of both Rust and Python, I would put them on the same or very very close level in terms of memory safety personally. Certainly within the same tier.
- dahfizz 4y ago
  You make a good point that much of pythong stdlib is implemented in C. But you could implement python's list in pure python, safely. You can't implement something like that in rust without unsafe.
  - kibwen 4y ago
    You can implement lists in Rust safely; with enums, a list is four lines of safe code. You can even implement a doubly-linked list safely. You just can't do either of these things by wielding pointers willy-nilly. If you're willing to accept a performance tradeoff by implementing a list in pure, bootstrapped, FFI-free Python, then you can do the same in Rust.
  - alserio 4y ago
    How would you implement a python list in python? I mean, what would you consider "acceptable" primitives to do so?
  - burntsushi 4y ago
    You certainly can! And that's a good example, because it exposes just how important context is to this discussion. Perf matters in certain contexts. If you implemented a list in pure Python, do you think its users would find the overall perf of Python to be acceptable?
Ar-Curunir 4y ago
One could implement many data structures without unsafe, but with less efficiency. E.g. using an arena allocator
- dahfizz 4y ago
  Sure, but that is kind of what I mean. Safety in rust is something you actively have to think about and work around (at least some of the time). It doesn't just come for free like in python.
  - bogeholm 4y ago
    Point is, “for free like like in Python” really means “the C implementation hides that for you”
- estebank 4y ago
  I would like to dispute the "with less efficiency" simplification, because depensing on the size and usage patterns of your code, a doubly linked list or sikilar graph datastructure, backed by an arena will be faster than the way those data structures appear in books.
kllrnohj 4y ago
> I think a distinction can be made in that you never really need to use unsafe operations in python or Java. You can't write any code at all in Python or Java without relying on unsafe operations. Both of them have their runtimes written in C/C++. So based off of this unusual line of reasoning, Rust is strictly more memory safe than either of those as it's at least possible to have a Rust program without any unsafe code. That program will be of questionable value, sure, but it can at least exist at all whereas it can't for Python or Java.
- fiedzia 4y ago
  > You can't write any code at all in Python or Java without relying on unsafe operations. There are Python interpreters written in other languages: there is one in Rust, and there is Jython and IronPython.
- dahfizz 4y ago
  By that logic, you can't write any safe rust at all because it relies on a compiler written in C++. We are discussing the languages themselves, not any particular implementation.
  - steveklabnik 4y ago
    Only the codegen and many optimization parts of the compiler is in C++. The rest of it is in Rust.
- masklinn 4y ago
  > You can't write any code at all in Python or Java without relying on unsafe operations. Both of them have their runtimes written in C/C++. Technically, pypy is a Python runtime written in Python.
- pjmlp 4y ago
  There are at least three Java runtimes written in Java, Jikes RVM, MaximeVM, and GraalVM.
  - 4y ago

burntsushi 4y ago

I suppose reasonable people can disagree, but I don't think it's anywhere near as clear cut as you seem to be implying. You talk about data structures in std using unsafe, but you don't mention the heaps and piles of C code used to implement CPython's standard library. It's not like you need `unsafe` in Rust to build every data structure. I build oodles of data structures on top of the fundamental primitives provided by std without using any `unsafe` explicitly whatsoever. And it is not at all uncommon to write application code in Rust that doesn't utter `unsafe` at all. Even ripgrep has almost none of it. At the "application" level it has exactly two uses: one related to PCRE2 shenanigans and one related to the use of file backed memory maps. Both of those things are optional. Then there's another whole perspective here, which is that if you're using Rust in the first place, there's a non-trivial chance you're working on something "low level" that might require `unsafe`. Where as with Python you probably aren't doing "low level" work and just don't care much about perf within certain contexts. That has less (albeit not "nothing") to do with the design of the languages and more to do with the problems you're trying to solve. To be clear, I am not saying you're definitely wrong. But as someone who has written many tens of thousands of lines of both Rust and Python, I would put them on the same or very very close level in terms of memory safety personally. Certainly within the same tier.

dahfizz 4y ago
You make a good point that much of pythong stdlib is implemented in C. But you could implement python's list in pure python, safely. You can't implement something like that in rust without unsafe.
- kibwen 4y ago
  You can implement lists in Rust safely; with enums, a list is four lines of safe code. You can even implement a doubly-linked list safely. You just can't do either of these things by wielding pointers willy-nilly. If you're willing to accept a performance tradeoff by implementing a list in pure, bootstrapped, FFI-free Python, then you can do the same in Rust.
- alserio 4y ago
  How would you implement a python list in python? I mean, what would you consider "acceptable" primitives to do so?
- burntsushi 4y ago
  You certainly can! And that's a good example, because it exposes just how important context is to this discussion. Perf matters in certain contexts. If you implemented a list in pure Python, do you think its users would find the overall perf of Python to be acceptable?

Ar-Curunir 4y ago

One could implement many data structures without unsafe, but with less efficiency. E.g. using an arena allocator

dahfizz 4y ago
Sure, but that is kind of what I mean. Safety in rust is something you actively have to think about and work around (at least some of the time). It doesn't just come for free like in python.
- bogeholm 4y ago
  Point is, “for free like like in Python” really means “the C implementation hides that for you”
estebank 4y ago
I would like to dispute the "with less efficiency" simplification, because depensing on the size and usage patterns of your code, a doubly linked list or sikilar graph datastructure, backed by an arena will be faster than the way those data structures appear in books.

kllrnohj 4y ago

> I think a distinction can be made in that you never really need to use unsafe operations in python or Java. You can't write any code at all in Python or Java without relying on unsafe operations. Both of them have their runtimes written in C/C++. So based off of this unusual line of reasoning, Rust is strictly more memory safe than either of those as it's at least possible to have a Rust program without any unsafe code. That program will be of questionable value, sure, but it can at least exist at all whereas it can't for Python or Java.

fiedzia 4y ago
> You can't write any code at all in Python or Java without relying on unsafe operations. There are Python interpreters written in other languages: there is one in Rust, and there is Jython and IronPython.
dahfizz 4y ago
By that logic, you can't write any safe rust at all because it relies on a compiler written in C++. We are discussing the languages themselves, not any particular implementation.
- steveklabnik 4y ago
  Only the codegen and many optimization parts of the compiler is in C++. The rest of it is in Rust.
masklinn 4y ago
> You can't write any code at all in Python or Java without relying on unsafe operations. Both of them have their runtimes written in C/C++. Technically, pypy is a Python runtime written in Python.
pjmlp 4y ago
There are at least three Java runtimes written in Java, Jikes RVM, MaximeVM, and GraalVM.
- 4y ago