11 ms·
C-rusted: The advantages of Rust, in C, without the disadvantages
- anon291 4y agoCool, but the paper's criticism of rust as a moving target also applies to the various pre-processor annotations in C-rusted. While true that the C preprocessor is used to make the annotations vanish (thus yielding normal C code), it is disingenuous to claim that the standardization of ISO C means that C-rusted is a stable target for any programming project. If you take that at its word what you get is that the unsafe language is standardized, but the safety features are not, which means that it is very easy to leak incorrect code to the C compiler, and then customers.
- api 4y agoRust is much less of a moving target the longer it’s around. It’s been pretty stable for some time with only improvements at the edges that don’t break backward compatibility. Most of these seem to be filling in gaps in the type system’s capabilities or rounding out the standard library. Has there been a breaking change in the past few years?
- kramerger 4y ago"pretty stable for some time" is not the endorsement you think it is. Some companies don't even use C++17 and stick to C++14. At the same time, Rust has grown to a large and complex thing and deserves a large update to make it more dev friendly (what C++ did years ago). I expect at least one big update before it can settle.
- tialaramex 4y agoIt's true that somehow C++ programmers rationalise completely new programming languages with incompatible syntax every three years as "stable" and Rust's stability as "unstable" but turns out that the people actually developing it don't agree with you that just changing everything would somehow make it "settle".
- pjmlp 4y agoThat stability comes in a dead trees tome that everyone should certify their compilers against.
- iknowstuff 4y agoNah, this is not a universal truth.
- tialaramex 4y ago> That stability comes in a dead trees tome No such "dead trees tome" exists. ISO will explicitly point out that what you're spending an eye-watering sum of money on is just a PDF. Some of the National Bodies will tell you that you can buy this document on paper, but what they're actually doing is contracting out to a local Print On Demand service which either didn't tell them it has a document size limit or they didn't listen. If you splash out anyway eventually what you'll get in the post, instead of your imaginary tome is a CD with the PDF on it. > that everyone should certify their compilers against. Try for a moment to imagine that all the GCC and Clang volunteers own legal copies of the actual ISO document. Now, stop laughing and read. Nobody cares about the actual document, in 1998 there really were academic libraries who bought C++ 98, and they might still have C++ 98, but that's a 25 year old document. Today those libraries would tell an interested user, "I'm pretty sure this is online, go away and search" and they'd be correct. Because it's a PDF not a paper document, ISO C++ is a moving target, what's stable about that? One of the few things about C++ that I unambiguously admire is std::format() introduced in C++ 20 -- but actually the most important feature of std::format() wasn't in the published C++ 20 ISO document, it's an erratum, pasted in much later because it's obviously needed.
- iknowstuff 4y agoIt has that, it's called editions which have in fact made our lives easier. You don't seem to understand that editions don't break backward compatibility. Those companies would be welcome to keep using Rust 2019, but they won't have to because Rust tooling is not a nightmare, unlike C++.
- pjmlp 4y agoEditions can only represent basic changes and the standard library isn't part of them.
- dataangel 4y agoThe editions mechanism is incredibly weak, every time I ask "Can this be fixed with an edition?" The answer is no.
- kramerger 4y ago> Rust tooling is not a nightmare, unlike C++. Please try this: 1. Install rustup on a clean Ubuntu 22.04 x64 2. Open the rust embedded book, go to the getting started chapter 3. Try the first part Early in the tutorial "cargo install cargo-geneate" will gail due to E0282 in git-glob...
- staunton 4y agoSome companies stick to ANSI-C and use a compiler binary from the 90s because new things are scary™. So what exactly does that tell us?
- kramerger 4y agoThat people claiming Rust is stable don't really understand the industry?
- comex 4y agoRust code tends to rely extensively on generic containers to encapsulate various safety properties. That will be hard to replicate in C. Still, I’d like to see how it works out in practice. But where’s the code? Judging by the website for ECLAIR, which is the basis of C-rusted according to the paper, it may not be open source: https://www.bugseng.com/eclair https://www.bugseng.com/eclair In that case, it may still be useful in the tradition-heavy world of safety-critical embedded applications (which the paper alludes to in mentioning MISRA and certified toolchains), where each codebase is a proprietary island. But it won’t be usable for general-purpose C programs or libraries, nor will it be possible for the community to evaluate on its merits.
- jchw 4y agoIn my opinion, it's terribly disingenuous for them to argue in favor of this approach and use TypeScript as an example without acknowledging that a great deal of making TypeScript practically useful involved investment into adoption and support, and the open nature of it. C-rusted will never expand beyond a niche of some industries if not opened in some form, and likely, if it's actually a good idea another tool will eventually eclipse it. That's a shame, as it seems like a pretty decent idea, even if I feel like the paper is written a bit like an advertisement (it feels a fair bit biased: it's hard to argue that you can't adopt Rust incrementally at all even if it doesn't allow for gradual adoption in the same manner as C-rusted or TypeScript. Also, it definitely doesn't demonstrate a similar competency towards being able to express things safely as Rust does.)
- jacquesm 4y agoYou can do this. But it isn't C anymore, it's just a DSL on top of C and because it is a thing that is layered on top of an existing language that language is still there and you will have to make sure that someone doesn't simply use the original unsafe language constructs. I've built a thing like this for a project that had zero tolerance for any of C's well deserved faults, and yet, had to be written in C. I borrowed heavily from various other solutions (notably: Erlang) to ensure that the project was as safe as I could possibly make it. But I was always acutely aware that it only took one team member to declare a void * to an unbounded array for things to break out of that carefully constructed illusion of a safe jail. Most of the work was done using some pretty tricky (and nifty!) macros and I really liked the end result, but I would have very much wished for that end result to be based on something more solid than C as the foundation. If you go down this route in the present day, unless you absolutely have to use something else. You'll be far happier and you will not have to be eternally vigilant against someone taking a shortcut.
- sheepscreek 4y agoThis sounds like JavaScript: The Good Parts revisited. Agree with everything you’ve written. However, in the rare situation that one has to go down this path, a linter/static code analyzer can prove to be a life saver. Found some on this page: https://github.com/caramelomartins/awesome-linters#cc https://github.com/caramelomartins/awesome-linters#cc
- ttfkam 4y agoLuckily, no one ever used The Bad Parts again after that book was published. Even getting folks to reliably use a linter can be a chore. Getting all C coders current and future to use these new techniques seems wildly optimistic to me.
- pulse7 4y agoIt's certainly better with such safety annotations than without...
- 4y ago
- 29athrowaway 4y agoNot a new idea. There's plenty of prior art: - Cyclone: https://www.cs.cornell.edu/projects/cyclone/ https://www.cs.cornell.edu/projects/cyclone/ (2002) - SAL: https://learn.microsoft.com/en-us/cpp/code-quality/understanding-sal?view=msvc-170 https://learn.microsoft.com/en-us/cpp/code-quality/understan... Not to mention languages that are generally safer such as Ada. They also fail to present a code example that looks more ergonomic than Rust.
- asveikau 4y agoHaving worked at Microsoft where SAL is used extensively, I can tell you it's entirely inadequate for actually preventing memory safety issues. At best it can give you things in the category of better warnings. At worst, you can annotate incorrectly or not at all, so it doesn't even work with correct info.
- pjmlp 4y agoWhich kind of proves the point of all these approaches not being able to be nothing more than bandaids.
- asveikau 4y agoI'm not sure it does prove it. It could just be a story of poor execution.
- 29athrowaway 4y agoBut that was not the way it was sold to developers and stakeholders.
- woodruffw 4y agoAlso from MS: Checked C[1], which aims to detect many of the same bug classes. I agree entirely about the ergonomics, and I think the authors also oversell what “safe” means for C-rusted-checked code, versus what safe means in Rust. There are some nice ideas here (and I’d like to see the implementation!), but it’s a stretch to say that something as incremental as this can provide the same program-wide guarantees that safe languages can. [1]: https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/
- randyrand 4y agoWow I was literally thinking about this idea yesterday. It’s a great idea I hope it catches on.
- bsaul 4y agoalthough this comment doesn't add anything to the conversation, i find the downvote a bit harsh. I think anybody experience this surprise of seeing someone else have the exact same idea as ours at some point. Then after a bit of time one realize zeitgeist is a super powerful thing and accepts the idea that "having a great idea" isn't something that exceptional nor valuable. Implementing the idea is.
- EamonnMR 4y agoThis seems more like the disadvantages rust, with the disadvantages of C. What I really want is the footguns of C with the ergonomic modern veneer of Rust's nicer syntax, built-in types, control structures etc.
- faisal_ksa 4y agoMaybe Zig[1]? [1]: https://ziglang.org/ https://ziglang.org/
- EamonnMR 4y agoI'm still waiting on a Zig book.
- JoshTriplett 4y ago> What I really want is the footguns of C with the ergonomic modern veneer of Rust's nicer syntax, built-in types, control structures etc Would unsafe Rust work for that, or is there a C footgun you need that that doesn't provide?
- gpm 4y agoUsing unsafe rust to try and write "rust without safety" doesn't work particularly well IMHO. Arguably that's a feature, unsafe rust is meant for implementing things that you couldn't implement in safe rust, not meant for just wholesale avoiding the borrow checker and going on with your life. The biggest thing that is missing is a `->` operator (or the safe-rust solution of auto dereferencing with `.`, which is disabled for raw ptrs). Having to write (*foo).bar all over the place is not a good experience. The second biggest thing that is missing is a footgun. Auto casting integer types all over the place. To different integer types. To offsets for pointers. Etc. Disclaimer: It's been a few years since I really dug into the unsafe side of the language, maybe things have "improved"?
- pcwalton 4y agoI really want -> in Rust too (or perhaps .*). I don't see why such a thing would be controversial.
- Animats 4y ago"The analysis is rigorously intraprocedural, i.e., it is done one function at a time, using only the information available for that function in the translation unit defining it, which includes the annotations possibly provided in function declarations." So, in the examples, when something calls "read", what does the analyzer know about "read", and how much of its "char *" buffer it overwrites? If you're going to do formal static analysis, the big wins come from automatically detecting that thing A is inconsistent with thing B way over on the other side of the project. That's the stuff humans miss. If you have to annotate everything to death, nobody will use your tool. This is sort of an ad for the "ECLAR software verification platform", which is apparently some expensive tool. The site is all onboarding, no info, "ask for quote" B2B. From the paper, you can't tell much about what they're doing. From the ECLAIR site, you can't tell much about what they're doing. So, no clue if this is a good idea or not. [1] https://www.bugseng.com/eclair https://www.bugseng.com/eclair
- voxl 4y agoAh, thank you for pointing this out, it all makes a lot more sense to me now. The table in the paper alone was a giant red flag for me.
- jcranmer 4y agoI don't remember the original source, but there's some classic frustration with these kinds of tables in academic papers. It's a "look at us, we're good at everything!" selective cherry-picking that omits honest discussion about the limitations of the approach. Although honestly, the red flag for me was the mention of a "field-sensitive" analysis in C. My experience doing static analysis on C code is that it tends to be so reliant on type punning that field sensitivity ends up kind of not working, at least not without significant effort on detecting and handling type punning in some manner (to say nothing of all of the fun ways people figure out how to encipher pointers).
- uecker 4y agoI think showing with static analysis that existing C code is safe is very hard. But if you start with modern and cleanly written C and avoid certain techniques (such as type punning) I think it is clear that this can work. Rust fundamentally does nothing else.
- newman314 4y agoA missed chance to call it "C-rust-y" =)
- adastra22 4y agoOr “crust.”
- colordrops 4y agoThis sounds like the equivalent of Typescript for C.
- drewm1980 4y agocorrect. They say so in the paper.
- adastra22 4y ago“Crust” was right there, and you didn’t go for it.
- hbogert 4y agoWithout the disadvantages? What advantage does C hold over Rust if you value a composable language which is safe and expressive? With composable I mean the ease in which you can include a external library without having to study it first. Whenever I had to use C this was always a bottleneck and you resort to copy paste hell, with slight changes to the original source.
- girvo 4y agoThe biggest reason is so I can use all the existing embedded driver and library code without re-doing it. That comes with it’s own safety challenges of course.
- drewm1980 4y agoSafety critical software has laws it needs to follow. Testing and validation can be so expensive it doesn't make sense to touch old code. I'm an advocate of Rust for most software, mind you. The safety you get from enforcing ownership at function and crate boundaries is allowing the package ecosystem to grow rapidly at a high quality. The safety win partially mitigates the safety loss you get from adopting hundreds of small transitive dependencies maintained by random people on the internet. But if you've spend tens of thousands of dollars having engineers test and validate some piece of safety critical code, you're going to need a really good business case for touching it at all.
- jacquesm 4y ago> The safety win partially mitigates the safety loss you get from adopting hundreds of small transitive dependencies maintained by random people on the internet. That advantage may be temporary.
- uecker 4y agoIsn't this confusing memory safety with safety?
- the_arcadian 4y agoConfusion? No it's just flat out obfuscation.
- pjmlp 4y agoThis seems quite similar to Windows SAL attributes, it is better than nothing, but doesn't really get us there. https://learn.microsoft.com/en-us/cpp/code-quality/understanding-sal?view=msvc-170 https://learn.microsoft.com/en-us/cpp/code-quality/understan...
- medo-bear 4y ago[flagged]
- fritzschopen 4y agohow Rust will challenge the ethical issues in C? i.e.: - addictive design - corporate ownership of data - algo bias - weak cyber security - overemphasis on features Not saying C has all of them. Just let's use these issues as an ethics compass to discuss?
- kristiandupont 4y agoTypescript can type-check javascript files that are annotated with JSDoc comments. With those, you can express almost the entire type system of TS while keeping your files directly interpretable by the browser without preprocessing. Are there any experiments like that for C?
- jokoon 4y agoI have a hard time understanding what's going on here. Isn't that just some sort of static analysis?
- deleted 4y ago[deleted]
- 0xfedbee 4y ago[flagged]
- the_arcadian 4y agoI heard that systems programming used to be dangerous and scary but then Rust was invented so now its okay.
- deleted 4y ago[deleted]
- jmartin2683 4y agoNone of this matters unless it is universally applied. Requires a new language and ecosystem around it.
- ursuscamp 4y agoThey missed the opportunity to call it “crusty”
- ttfkam 4y ago"Crust of Rust" is already a thing. https://youtube.com/@jonhoo https://youtube.com/@jonhoo
- the_arcadian 4y ago> So, what does the current ferment about Rust tell us? That the industry is ready to accept that programmers take a more disciplined approach by embracing strong data typing enhanced with program annotations. I have a question. Who asked for this? Like who exactly raised their hand and said yes, I want a systems programming language that won't let me compile syntactically and semantically correct programs because they don't follow an arbitrary ownership model?
- Liquid_Fire 4y agoThis is like saying "who raised their hand and asked for a language where any number of trivial mistakes allowed by the compiler will lead to massive security holes?" No one, and yet we have C and people use it. No one "asks" for the disadvantages of a given language, they are just trade-offs in exchange for some advantages.
- the_arcadian 4y agoThe reason people use systems programming languages is because they need to efficiently and effectively manage and manipulate memory. That's why C was created in the first place - to write the 100,000+ lines of code that would become Unix Version 4 in 1973. (Not bad for a two year old language.) Which means that when you present me with a systems programming language that enforces an ownership concept that makes it much more difficult to write allocators or even doubly linked data structures, and then use that language's existence to justify adding the same restrictions into a version of C, "who asked for this?" might well be the least offensive response I can muster.
- Ygg2 4y ago> The reason people use systems programming languages is because they need to efficiently and effectively manage and manipulate memory. That's not true. Assembler and machine code predate C. And do the job much more effectively/efficiently. For example Menuet OS an OS in pure assembly has like 2MiB and has stuff like GUI, graphics, etc. What Linux does in hundreds of MiB. But they need to rewrite it for each hardware platform.