3 ms·

I work in aerospace, and it will be interesting to see when Rust will turn into the defacto standard for DAL-B or safer systems. However, if there is a language

I work in aerospace, and it will be interesting to see when Rust will turn into the defacto standard for DAL-B or safer systems. However, if there is a language that can beat Ada, I think Rust is it, and this is one huge step to make this a reality.

cmrdporcupine 3y ago
Rust tries to ensure memory safety and, to some extent, makes efforts to solve some common concurrency issues through the same borrowing/ownership concepts. But while I'm not fluent in Ada I always got the impression it made attempts to provide some safety and explicitness in other areas, too? Putting it another way, I feel like Rust maybe doesn't have a complete answer to a lot of the problems that Ada has tried to answer.
- sheepybloke 3y ago
  Being strongly typed also helps! One other interesting thing is including the tests directly in the file you're writing in. To me, that will be incredibly helpful when doing certification and verification.
  - tonyarkles 3y ago
    The Ada type system is very very interesting to me. For instance, type ranges[0] make it impossible to represent an invalid value. There's a lot of power there and the associated static analysis can catch things that otherwise would be tricky to catch at compile-time. [0] https://learn.adacore.com/courses/Ada_For_The_CPP_Java_Developer/chapters/05_Type_System.html#type-ranges https://learn.adacore.com/courses/Ada_For_The_CPP_Java_Devel...
- nordsieck 3y ago
  > But while I'm not fluent in Ada I always got the impression it made attempts to provide some safety and explicitness in other areas, too? Yeah - Ada has stuff like range types. So you can embed (some) function contracts into the type system. I suspect, though, that memory safety is one of the most important kinds of safety. Especially if modern systems are going to be multi-threaded.
  - OneWingedShark 3y ago
    > I suspect, though, that memory safety is one of the most important kinds of safety. I don't. It seems to me like "memory-safety" is a response to the legacy of C and "C-compatibility) WRT poor behavior/respect of types; example: int/address punning, int/boolean punning, array/pointer punning, etc. (NUL-terminated stings could fit here, too as they're a consequence of C's address/array confusion.) Contrary to this, would be correct typing. Consider SQL-injection and how the "best practice" is to never take data from the user... well we can take data from the user AND ensure there's no possibility of injection: Subtype Numeric is String with Dynamic_Predicate => (for all C of Numeric => C in '0'..'9'), Predicate_Falure => raise Constraint_Error with "'" & Numeric &"' is not numeric."; --... Count : Numeric renames Get_User_Value; --... return Query("SELECT \* FROM Some_Table WHERE Count=" & Count & ";"); The above is perfectly safe because the constraint imposed prohibits the SQL-injection... and you can even enforce something like SQL_Escaping: PACKAGE Example IS -- The only way to get a value of ESCAPED_STRING is via calling Create. Type Escaped_String is private; Function Create( X:String ) return Escaped_String; PRIVATE Type Escaped_String is new String; Function Create( X:String ) return Escaped_String is ( SQL_Escape(X) ); END Example;
  - inferiorhuman 3y ago
    Although Rust doesn't have range types they do have non-zero integer types (so a start anyways) and I'm pretty sure there's an open RFC on proper range types.
  - orlp 3y ago
    > I suspect, though, that memory safety is one of the most important kinds of safety. I don't agree, at least in the context of safety that Ada is typically mentioned in. Safety in this context is generally about human lives. Memory safety is by far the most important kind of safety against exploits. Because memory safety bugs lead to arbitrary code execution and a total security breakdown. However, where Ada is used most often - safety-critical and realtime systems in airplanes or medical equipment and such - most of the code is written for embedded systems. The attack surface is generally miniscule if any. The vast majority of issues that these contexts face I reckon are unit conversion errors, off-by-one errors, type overflows and logic errors.
- naruhodo 3y ago
  It's been a long time since I have touched Ada and I don't really know Rust. But I do know that Ada allows you to specify the range of custom numeric types[1]: type Page_Num is range 1 .. 2_000; type Line_Size is range 1 .. Max_Line_Size; subtype Buffer_Size is Integer range 0 .. Max; type Byte is mod 256; -- an unsigned byte type Hash_Index is mod 97; -- modulus is prime Looking around, I see that the Rustaceans are working on ranged types, as discussed here[2]. They even mention Ada. And there is a PR for a ranged types MVP here[3], which was ultimately closed to do some more thinking. [1] https://www.adaic.org/resources/add_content/standards/05rm/html/RM-3-5-4.html https://www.adaic.org/resources/add_content/standards/05rm/h... [2] https://github.com/rust-lang/rfcs/issues/671 https://github.com/rust-lang/rfcs/issues/671 [3] https://github.com/rust-lang/rust/pull/107606 https://github.com/rust-lang/rust/pull/107606
  - cmrdporcupine 3y ago
    This looks like another set of Rust proposals that are going to go exactly nowhere. Skimming, looks like the PR was closed, and the RFC has been open since 2015. Again, Rust is a great language. I work in it fulltime. But this is not a focus it currently has. Hell, they can't seem to get allocator-api and simd stable, after years. Embedded has taken a very... backseat to webby, async stuff, unfortunately.
    - estebank 3y ago
      As much effort as the team outs on having a coherent progression and cater to as many customers as possible, Rust is still a show-up-ocracy. If there aren't people with enough desire to implement a proposal, it doesn't happen. Features have stalled because of fundamental issues that require going back to the drawing board (allocator api), sometimes for CS research level (specialization) or usability (TAIT) questions, or the person working on the feature burned out right before the final push, and there was no one else to pick up the work afterwards.

cmrdporcupine 3y ago

Rust tries to ensure memory safety and, to some extent, makes efforts to solve some common concurrency issues through the same borrowing/ownership concepts. But while I'm not fluent in Ada I always got the impression it made attempts to provide some safety and explicitness in other areas, too? Putting it another way, I feel like Rust maybe doesn't have a complete answer to a lot of the problems that Ada has tried to answer.

sheepybloke 3y ago
Being strongly typed also helps! One other interesting thing is including the tests directly in the file you're writing in. To me, that will be incredibly helpful when doing certification and verification.
- tonyarkles 3y ago
  The Ada type system is very very interesting to me. For instance, type ranges[0] make it impossible to represent an invalid value. There's a lot of power there and the associated static analysis can catch things that otherwise would be tricky to catch at compile-time. [0] https://learn.adacore.com/courses/Ada_For_The_CPP_Java_Developer/chapters/05_Type_System.html#type-ranges https://learn.adacore.com/courses/Ada_For_The_CPP_Java_Devel...
nordsieck 3y ago
> But while I'm not fluent in Ada I always got the impression it made attempts to provide some safety and explicitness in other areas, too? Yeah - Ada has stuff like range types. So you can embed (some) function contracts into the type system. I suspect, though, that memory safety is one of the most important kinds of safety. Especially if modern systems are going to be multi-threaded.
- OneWingedShark 3y ago
  > I suspect, though, that memory safety is one of the most important kinds of safety. I don't. It seems to me like "memory-safety" is a response to the legacy of C and "C-compatibility) WRT poor behavior/respect of types; example: int/address punning, int/boolean punning, array/pointer punning, etc. (NUL-terminated stings could fit here, too as they're a consequence of C's address/array confusion.) Contrary to this, would be correct typing. Consider SQL-injection and how the "best practice" is to never take data from the user... well we can take data from the user AND ensure there's no possibility of injection: Subtype Numeric is String with Dynamic_Predicate => (for all C of Numeric => C in '0'..'9'), Predicate_Falure => raise Constraint_Error with "'" & Numeric &"' is not numeric."; --... Count : Numeric renames Get_User_Value; --... return Query("SELECT \* FROM Some_Table WHERE Count=" & Count & ";"); The above is perfectly safe because the constraint imposed prohibits the SQL-injection... and you can even enforce something like SQL_Escaping: PACKAGE Example IS -- The only way to get a value of ESCAPED_STRING is via calling Create. Type Escaped_String is private; Function Create( X:String ) return Escaped_String; PRIVATE Type Escaped_String is new String; Function Create( X:String ) return Escaped_String is ( SQL_Escape(X) ); END Example;
- inferiorhuman 3y ago
  Although Rust doesn't have range types they do have non-zero integer types (so a start anyways) and I'm pretty sure there's an open RFC on proper range types.
- orlp 3y ago
  > I suspect, though, that memory safety is one of the most important kinds of safety. I don't agree, at least in the context of safety that Ada is typically mentioned in. Safety in this context is generally about human lives. Memory safety is by far the most important kind of safety against exploits. Because memory safety bugs lead to arbitrary code execution and a total security breakdown. However, where Ada is used most often - safety-critical and realtime systems in airplanes or medical equipment and such - most of the code is written for embedded systems. The attack surface is generally miniscule if any. The vast majority of issues that these contexts face I reckon are unit conversion errors, off-by-one errors, type overflows and logic errors.
naruhodo 3y ago
It's been a long time since I have touched Ada and I don't really know Rust. But I do know that Ada allows you to specify the range of custom numeric types[1]: type Page_Num is range 1 .. 2_000; type Line_Size is range 1 .. Max_Line_Size; subtype Buffer_Size is Integer range 0 .. Max; type Byte is mod 256; -- an unsigned byte type Hash_Index is mod 97; -- modulus is prime Looking around, I see that the Rustaceans are working on ranged types, as discussed here[2]. They even mention Ada. And there is a PR for a ranged types MVP here[3], which was ultimately closed to do some more thinking. [1] https://www.adaic.org/resources/add_content/standards/05rm/html/RM-3-5-4.html https://www.adaic.org/resources/add_content/standards/05rm/h... [2] https://github.com/rust-lang/rfcs/issues/671 https://github.com/rust-lang/rfcs/issues/671 [3] https://github.com/rust-lang/rust/pull/107606 https://github.com/rust-lang/rust/pull/107606
- cmrdporcupine 3y ago
  This looks like another set of Rust proposals that are going to go exactly nowhere. Skimming, looks like the PR was closed, and the RFC has been open since 2015. Again, Rust is a great language. I work in it fulltime. But this is not a focus it currently has. Hell, they can't seem to get allocator-api and simd stable, after years. Embedded has taken a very... backseat to webby, async stuff, unfortunately.
  - estebank 3y ago
    As much effort as the team outs on having a coherent progression and cater to as many customers as possible, Rust is still a show-up-ocracy. If there aren't people with enough desire to implement a proposal, it doesn't happen. Features have stalled because of fundamental issues that require going back to the drawing board (allocator api), sometimes for CS research level (specialization) or usability (TAIT) questions, or the person working on the feature burned out right before the final push, and there was no one else to pick up the work afterwards.