11 ms·

A Decade of Rust, and Announcing Ferrocene

135 points by sbt567 3y ago

onesphere 3y ago
Np(C8H8)2
insanitybit 3y ago
https://ferrous-systems.com/ferrocene/ https://ferrous-systems.com/ferrocene/ This link contains more information. I guess some sectors care about having a compiler that conforms to some sort of ISO standards. This doesn't really tell me what that means but I know that I'm not the target.
- MHard 3y ago
  The standards mentioned in the article seem to be required to deploy rust code as part of safety critical systems in cars and other industrial applications. This might be a big deal to get rust code into cars but I’m just guessing
- rcxdude 3y ago
  It means you can use it in certain safety critical applications, and works as a proof of some extra verification work compared to a non-certified piece of software. Probably most of it you only care about if you need that specific standard for your specific application due to some regulations, but also if you want to have a greater than normal level of confidence that it will work as expected.
  - insanitybit 3y ago
    I get that it means that, I meant it doesn't tell me what getting that certification entails - someone else mentioned it involves things like tests to ensure certain behaviors.
- Xylakant 3y ago
  I'd like to clarify a little here: There's an ISO certifiation in here - but it's not an ISO standard for the language. Essentially, the ISO 26262 certification mostly verifies that the compiler release process conforms to a certain standard. It does not create an ISO standard for rust, not does it aim to. At part of the certification process we had to write a spec for the rust language, but it is a descriptive spec of how certain aspects of the rust language behave for one specific release of the compiler. The certification builds on this to ensure that tests catch deviations between spec and implementation, known problems are documented etc. So rust as a language is unaffected, as is the rust project. The spec is open source and might be useful to others, you can find it at https://spec.ferrocene.dev/ https://spec.ferrocene.dev/ The target sectors for ISO 26262 and related industrial certification are clearly sectors that require such certification: automotive, medical, etc. Ferrocene itself however, is not only the ISO certified downstream of the rust compiler, it also offers for example long term support and tracking of known issues which the rust project does not provide. This is also important for certain applications that do not strictly require certifications. Disclosure: I'm one of the founders of Ferrous Systems, but I'm only involved in the Ferrocene project on a moderately high level, so forgive minor technical inaccuracies :)
  - jeddy3 3y ago
    > Essentially, the ISO 26262 certification mostly verifies that the compiler release process conforms to a certain standard. It does not create an ISO standard for rust, not does it aim to. Sorry for a stupid question, but what does this mean? Is it only that Rust itself (the language) is no use in a certification, but rather a specific compiler version? I.e. basically leading to the same outcome in the end. Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project?
    - steveklabnik 3y ago
      Not your parent, and haven't worked directly in these areas, but this is my understanding. "certification" is something that is done to a process that produces a software artifact. So yes, in some sense it is "particular compiler version." The result of certification says "this compiler will do this when given this, and here is how we ensure that that is true, and here's the process for when that's not true, etc etc etc." Users can then use that specific compiler. > I.e. basically leading to the same outcome in the end. The difference is pretty important. Getting this certification does not require that the abstract concept of the Rust language is being specified in any specific way. It does require that a specific inputs to the compiler are described, and because compatibility with upstream Rust is desired, those specific inputs happen to map to inputs to rustc that are identical, but it is important to understand that this can happen completely independently of what the Rust Project decides is best for the language; this is a downstream project. In theory, if the Rust project wanted a specification, starting with some of the work Ferrocene has done would be an option. But the qualification process doesn't require that. > Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project? The opposite, this means you can use Rust in these places. Even though this work does not specify Rust.
- andrewl-hn 3y ago
  Usually, it means that there's a whole lot of paperwork done to say "This specific version of the compiler can run on that specific combination of hardware" with extra things like "if you try to do A, B, or C it will break this or that way, so don't do it". Note that it doesn't have to be a separate version with patches - it may as well be a recent stable release of Rust. But the paperwork has to be created just fro this release. And these standards require a team to spend months and months documenting everything. That's why having it all done by a vendor like Ferrous Systems is attractive: once the work is done adapting it to some other "compiler version + hardware" combination will take a lot less time. There was an audio interview where Ferrous people talked about it https://rustacean-station.org/episode/067-quentin-ochem-florian-gilcher/ https://rustacean-station.org/episode/067-quentin-ochem-flor...
  - Xylakant 3y ago
    > it may as well be a recent stable release of Rust. It essentially is, we're pretty open about this. There's a tiny patchset that's required to enable some guarantees (literally a handful of patches), none of them of interest to the upstream project. Every major change has been contributed upstream. Even the spec that was built as part of the effort is open source.
    - kouteiheika 3y ago
      > There's a tiny patchset that's required to enable some guarantees (literally a handful of patches), none of them of interest to the upstream project. Do you perhaps have a link where we could see those patches? Purely for curiosity's sake.
      - Xylakant 3y ago
        No, for mostly organizational reasons this lives in a private repo that we can't easily grant access to. I'll take that on my list of things that we should consider, but we're pretty busy right now - so no promises.
- lumisota 3y ago
  Some nice background reading on these standards here: https://solidsands.com/safety/iso-26262 https://solidsands.com/safety/iso-26262
- markstos 3y ago
  ISO 26262 specifically mentions automotive applications. This seems to a step towards using Rust in critical automotive systems. https://en.wikipedia.org/wiki/ISO_26262 https://en.wikipedia.org/wiki/ISO_26262
qzw 3y ago
> Ferrocene goes beyond the compiler in keeping all aspects of the software being built in mind, particularly the distribution, traceability and use of own or foreign libraries. We’re committed to providing secure, auditable distribution channels for these toolchain updates. Active communication of issues to clients and helping with fixes rounds up the package. Does this mean they're going to have a curated subset of crates they'll be willing to vouch for? Cool if true, but sounds like a very significant amount of work.
- kibwen 3y ago
  > Cool if true, but sounds like a very significant amount of work. Not coincidentally, it's the sort of work that the sort of people who use verified compilers have the incentive to pay for.
  - qzw 3y ago
    Undoubtedly, and having a compliant compiler without being able to use any external crates would certainly be a major downer, so I'm sure they've thought this through and done their market research.
- zokier 3y ago
  I imagine they will want to provide/audit all the dependencies of rust toolchain which is already hundreds(?) of crates. It probably isn't much extra work to offer the same crates as some sort of platform.
pnathan 3y ago
This is fantastic. I've been doing more Rust hacking at home and I genuinely think that this next decade will be just gangbusters for Rust; its gotten a lot of early adoption, and the next wave is going to be wild. one of these days I'll work at a Rust shop, and I am hyped for that possibility. it'll be NICE.
- bagavi 3y ago
  https://jobs.ashbyhq.com/matician/56979df7-cb5e-45c3-baa9-3e1d9c8c2eb0 https://jobs.ashbyhq.com/matician/56979df7-cb5e-45c3-baa9-3e...
  - brink 3y ago
    Who is going to pay $75/mo for a vacuum when they can get a shark robot vacuum for a one time payment of $500? It sounds like the Juicero of floor cleaning. Apparently VC's haven't learned their lesson yet.
    - elorm 3y ago
      You’ve obviously never owned a dirt ingesting shark robot vacuum. There are hundreds of thousands of Americans who’ll pay $75/mo for unlimited repairs and maintenance and never having to worry about if the toddler takes the vacuum cleaner for a tumble down the stairs.
      - stusmall 3y ago
        I'm on my second roomba in well over a decade. I don't remember what happened to the first one, I think I gave it away in a move, but it didn't break. I don't know anything about the shark brand but I've never really thought twice about repair problems with roomba or heard about issues from friends. Obviously a small sample size, but this is something I don't get as a subscription. That said, Matician's vision mapping looks really cool.
    - thoughtpalette 3y ago
      I'm going to echo you, $75/mo for a better Roomba imo is wild. I am very impressed by the custom SLAM and the privacy focused, but it's a reoccurring subscription I couldn't justify. Curious who their target demographics are.
deleted 3y ago
[deleted]
constantcrying 3y ago
This sounds very good. Rust has inherent "x-th mover" problems in spaces where C or C++ is dominant and hard to replace, like automotive and aerospace. These are also the spaces where a language with stronger guarantees and which can target embedded real time devices, is more useful than almost everywhere else. For rust to succeed in those spaces a "community compiler" is just simply not an option. Having a standardized language (which is still not there yet) with a qualified compiler toolchain would be a significant step forward and actually makes it perspectively possible to use rust on projects for commercial aviation.
- adgjlsfhk1 3y ago
  IMO a standardize language isn't necessary. Pretty much no C compilers actually follow the C standard exactly (including verified ones). Also it's not like the C standard actually prescribes behavior in lots of cases. Tons of C is UB or implementation defined behavior.
  - constantcrying 3y ago
    To some extent you certainly need a standardized language and I don't think having rustc as the "defacto" standard is in any way acceptable to use it on an airplane. A compiler not complying with the standard is also not that problematic, as long as the deviation is known. UB should be avoided under all circumstances, but it is inherent to any language as spread out as C.
    - steveklabnik 3y ago
      > To some extent you certainly need a standardized language Because we're talking standards, precise wording is important. You do not need a standardized language in order to produce a qualified compiler. > I don't think having rustc as the "defacto" standard is in any way acceptable to use it on an airplane. This is true but not because it's a "defacto standard," it is because rustc does not fulfill the requirements to be qualified. Ferrocene, on the other hand, does. > A compiler not complying with the standard is also not that problematic, as long as the deviation is known. You're correct here, but that's directly in conflict with the "you need a standardized language," which is why I'd disagree with that portion of what you've said here.

135 points by sbt567 3y ago

Np(C8H8)2

https://ferrous-systems.com/ferrocene/ https://ferrous-systems.com/ferrocene/ This link contains more information. I guess some sectors care about having a compiler that conforms to some sort of ISO standards. This doesn't really tell me what that means but I know that I'm not the target.

MHard 3y ago
The standards mentioned in the article seem to be required to deploy rust code as part of safety critical systems in cars and other industrial applications. This might be a big deal to get rust code into cars but I’m just guessing
rcxdude 3y ago
It means you can use it in certain safety critical applications, and works as a proof of some extra verification work compared to a non-certified piece of software. Probably most of it you only care about if you need that specific standard for your specific application due to some regulations, but also if you want to have a greater than normal level of confidence that it will work as expected.
- insanitybit 3y ago
  I get that it means that, I meant it doesn't tell me what getting that certification entails - someone else mentioned it involves things like tests to ensure certain behaviors.
Xylakant 3y ago
I'd like to clarify a little here: There's an ISO certifiation in here - but it's not an ISO standard for the language. Essentially, the ISO 26262 certification mostly verifies that the compiler release process conforms to a certain standard. It does not create an ISO standard for rust, not does it aim to. At part of the certification process we had to write a spec for the rust language, but it is a descriptive spec of how certain aspects of the rust language behave for one specific release of the compiler. The certification builds on this to ensure that tests catch deviations between spec and implementation, known problems are documented etc. So rust as a language is unaffected, as is the rust project. The spec is open source and might be useful to others, you can find it at https://spec.ferrocene.dev/ https://spec.ferrocene.dev/ The target sectors for ISO 26262 and related industrial certification are clearly sectors that require such certification: automotive, medical, etc. Ferrocene itself however, is not only the ISO certified downstream of the rust compiler, it also offers for example long term support and tracking of known issues which the rust project does not provide. This is also important for certain applications that do not strictly require certifications. Disclosure: I'm one of the founders of Ferrous Systems, but I'm only involved in the Ferrocene project on a moderately high level, so forgive minor technical inaccuracies :)
- jeddy3 3y ago
  > Essentially, the ISO 26262 certification mostly verifies that the compiler release process conforms to a certain standard. It does not create an ISO standard for rust, not does it aim to. Sorry for a stupid question, but what does this mean? Is it only that Rust itself (the language) is no use in a certification, but rather a specific compiler version? I.e. basically leading to the same outcome in the end. Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project?
  - steveklabnik 3y ago
    Not your parent, and haven't worked directly in these areas, but this is my understanding. "certification" is something that is done to a process that produces a software artifact. So yes, in some sense it is "particular compiler version." The result of certification says "this compiler will do this when given this, and here is how we ensure that that is true, and here's the process for when that's not true, etc etc etc." Users can then use that specific compiler. > I.e. basically leading to the same outcome in the end. The difference is pretty important. Getting this certification does not require that the abstract concept of the Rust language is being specified in any specific way. It does require that a specific inputs to the compiler are described, and because compatibility with upstream Rust is desired, those specific inputs happen to map to inputs to rustc that are identical, but it is important to understand that this can happen completely independently of what the Rust Project decides is best for the language; this is a downstream project. In theory, if the Rust project wanted a specification, starting with some of the work Ferrocene has done would be an option. But the qualification process doesn't require that. > Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project? The opposite, this means you can use Rust in these places. Even though this work does not specify Rust.
andrewl-hn 3y ago
Usually, it means that there's a whole lot of paperwork done to say "This specific version of the compiler can run on that specific combination of hardware" with extra things like "if you try to do A, B, or C it will break this or that way, so don't do it". Note that it doesn't have to be a separate version with patches - it may as well be a recent stable release of Rust. But the paperwork has to be created just fro this release. And these standards require a team to spend months and months documenting everything. That's why having it all done by a vendor like Ferrous Systems is attractive: once the work is done adapting it to some other "compiler version + hardware" combination will take a lot less time. There was an audio interview where Ferrous people talked about it https://rustacean-station.org/episode/067-quentin-ochem-florian-gilcher/ https://rustacean-station.org/episode/067-quentin-ochem-flor...
- Xylakant 3y ago
  > it may as well be a recent stable release of Rust. It essentially is, we're pretty open about this. There's a tiny patchset that's required to enable some guarantees (literally a handful of patches), none of them of interest to the upstream project. Every major change has been contributed upstream. Even the spec that was built as part of the effort is open source.
  - kouteiheika 3y ago
    > There's a tiny patchset that's required to enable some guarantees (literally a handful of patches), none of them of interest to the upstream project. Do you perhaps have a link where we could see those patches? Purely for curiosity's sake.
    - Xylakant 3y ago
      No, for mostly organizational reasons this lives in a private repo that we can't easily grant access to. I'll take that on my list of things that we should consider, but we're pretty busy right now - so no promises.
lumisota 3y ago
Some nice background reading on these standards here: https://solidsands.com/safety/iso-26262 https://solidsands.com/safety/iso-26262
markstos 3y ago
ISO 26262 specifically mentions automotive applications. This seems to a step towards using Rust in critical automotive systems. https://en.wikipedia.org/wiki/ISO_26262 https://en.wikipedia.org/wiki/ISO_26262

qzw 3y ago

> Ferrocene goes beyond the compiler in keeping all aspects of the software being built in mind, particularly the distribution, traceability and use of own or foreign libraries. We’re committed to providing secure, auditable distribution channels for these toolchain updates. Active communication of issues to clients and helping with fixes rounds up the package. Does this mean they're going to have a curated subset of crates they'll be willing to vouch for? Cool if true, but sounds like a very significant amount of work.

kibwen 3y ago
> Cool if true, but sounds like a very significant amount of work. Not coincidentally, it's the sort of work that the sort of people who use verified compilers have the incentive to pay for.
- qzw 3y ago
  Undoubtedly, and having a compliant compiler without being able to use any external crates would certainly be a major downer, so I'm sure they've thought this through and done their market research.
zokier 3y ago
I imagine they will want to provide/audit all the dependencies of rust toolchain which is already hundreds(?) of crates. It probably isn't much extra work to offer the same crates as some sort of platform.

pnathan 3y ago

This is fantastic. I've been doing more Rust hacking at home and I genuinely think that this next decade will be just gangbusters for Rust; its gotten a lot of early adoption, and the next wave is going to be wild. one of these days I'll work at a Rust shop, and I am hyped for that possibility. it'll be NICE.

bagavi 3y ago
https://jobs.ashbyhq.com/matician/56979df7-cb5e-45c3-baa9-3e1d9c8c2eb0 https://jobs.ashbyhq.com/matician/56979df7-cb5e-45c3-baa9-3e...
- brink 3y ago
  Who is going to pay $75/mo for a vacuum when they can get a shark robot vacuum for a one time payment of $500? It sounds like the Juicero of floor cleaning. Apparently VC's haven't learned their lesson yet.
  - elorm 3y ago
    You’ve obviously never owned a dirt ingesting shark robot vacuum. There are hundreds of thousands of Americans who’ll pay $75/mo for unlimited repairs and maintenance and never having to worry about if the toddler takes the vacuum cleaner for a tumble down the stairs.
    - stusmall 3y ago
      I'm on my second roomba in well over a decade. I don't remember what happened to the first one, I think I gave it away in a move, but it didn't break. I don't know anything about the shark brand but I've never really thought twice about repair problems with roomba or heard about issues from friends. Obviously a small sample size, but this is something I don't get as a subscription. That said, Matician's vision mapping looks really cool.
  - thoughtpalette 3y ago
    I'm going to echo you, $75/mo for a better Roomba imo is wild. I am very impressed by the custom SLAM and the privacy focused, but it's a reoccurring subscription I couldn't justify. Curious who their target demographics are.

deleted 3y ago

[deleted]

constantcrying 3y ago

This sounds very good. Rust has inherent "x-th mover" problems in spaces where C or C++ is dominant and hard to replace, like automotive and aerospace. These are also the spaces where a language with stronger guarantees and which can target embedded real time devices, is more useful than almost everywhere else. For rust to succeed in those spaces a "community compiler" is just simply not an option. Having a standardized language (which is still not there yet) with a qualified compiler toolchain would be a significant step forward and actually makes it perspectively possible to use rust on projects for commercial aviation.

adgjlsfhk1 3y ago
IMO a standardize language isn't necessary. Pretty much no C compilers actually follow the C standard exactly (including verified ones). Also it's not like the C standard actually prescribes behavior in lots of cases. Tons of C is UB or implementation defined behavior.
- constantcrying 3y ago
  To some extent you certainly need a standardized language and I don't think having rustc as the "defacto" standard is in any way acceptable to use it on an airplane. A compiler not complying with the standard is also not that problematic, as long as the deviation is known. UB should be avoided under all circumstances, but it is inherent to any language as spread out as C.
  - steveklabnik 3y ago
    > To some extent you certainly need a standardized language Because we're talking standards, precise wording is important. You do not need a standardized language in order to produce a qualified compiler. > I don't think having rustc as the "defacto" standard is in any way acceptable to use it on an airplane. This is true but not because it's a "defacto standard," it is because rustc does not fulfill the requirements to be qualified. Ferrocene, on the other hand, does. > A compiler not complying with the standard is also not that problematic, as long as the deviation is known. You're correct here, but that's directly in conflict with the "you need a standardized language," which is why I'd disagree with that portion of what you've said here.