4 ms·

> Look for example at what we can do (safely!) with Rayon in Rust "Safely" for a certain kind of definition of safety: https://github.com/search?q=repo%3Arayon

> Look for example at what we can do (safely!) with Rayon in Rust "Safely" for a certain kind of definition of safety: https://github.com/search?q=repo%3Arayon-rs%2Frayon+unsafe&type=code https://github.com/search?q=repo%3Arayon-rs%2Frayon+unsafe&t...

SkiFire13 3y ago
The point is that the "unsafe" code is written and checked once, and then everyone can benefit from that. It's the same concept as encapsulation applied to memory/thread safety.
YoshiRulz 3y ago
The library uses `unsafe` so the consumer doesn't have to. But more to the point, to say "it uses the `unsafe` keyword, therefore it can't be safe" would be disingenuous, or at least very ignorant. The "certain kind of definition of safety" you're looking for would be 'soundness'[1]: a library using `unsafe` is considered 'sound' iff calling into it from safe Rust can never corrupt memory. When people say Rust is better for memory safety than e.g. C++, it's not because you can't write a provably-safe library with C++—you can do that with some effort. It's because the Rust language differentiates compiler-asserted safety from programmer-asserted safety via the `unsafe` keyword, an opt-in. [1]: https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library https://rust-lang.github.io/unsafe-code-guidelines/glossary.... (edit: Sniped, but I believe I've expanded upon the sibling comment.)
- menaerus 3y ago
  > "it uses the `unsafe` keyword, therefore it can't be safe" > ... would be disingenuous, or at least very ignorant. That's quite literally what it means - there is a "safe" Rust code that never uses the "unsafe" but the example given by the parent comment is just not the example of that. I am not sure why would my comment come out as ignorant - it's factual state of things. > it's not because you can't write a provably-safe library with C++ Hm, you really can't? Neither you can with safe or unsafe Rust. None of the compilers for those languages are formally verified.

SkiFire13 3y ago

The point is that the "unsafe" code is written and checked once, and then everyone can benefit from that. It's the same concept as encapsulation applied to memory/thread safety.

YoshiRulz 3y ago

The library uses `unsafe` so the consumer doesn't have to. But more to the point, to say "it uses the `unsafe` keyword, therefore it can't be safe" would be disingenuous, or at least very ignorant. The "certain kind of definition of safety" you're looking for would be 'soundness'[1]: a library using `unsafe` is considered 'sound' iff calling into it from safe Rust can never corrupt memory. When people say Rust is better for memory safety than e.g. C++, it's not because you can't write a provably-safe library with C++—you can do that with some effort. It's because the Rust language differentiates compiler-asserted safety from programmer-asserted safety via the `unsafe` keyword, an opt-in. [1]: https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library https://rust-lang.github.io/unsafe-code-guidelines/glossary.... (edit: Sniped, but I believe I've expanded upon the sibling comment.)

menaerus 3y ago
> "it uses the `unsafe` keyword, therefore it can't be safe" > ... would be disingenuous, or at least very ignorant. That's quite literally what it means - there is a "safe" Rust code that never uses the "unsafe" but the example given by the parent comment is just not the example of that. I am not sure why would my comment come out as ignorant - it's factual state of things. > it's not because you can't write a provably-safe library with C++ Hm, you really can't? Neither you can with safe or unsafe Rust. None of the compilers for those languages are formally verified.