9 ms·
Is Ada safer than Rust?
- frank_bb 3y agoAda is awesome! One of the greatest languages. Should be much more popular.
- pjmlp 3y agoSadly it suffered from high prices, and being extra tooling even on UNIX SDKs, until GNAT came to be. Still, not all languages can assert having 7 commercial vendors in business, lasting 40 years and counting.
- fulafel 3y agoIn case others were curious to look up the timeline, WP says first validated GNAT release was in 1995, vs 1983 for the earliest validated implementation. (but perhaps the earlier stuff wasn't practical: "Early Ada compilers struggled to implement the large, complex language, and both compile-time and run-time performance tended to be slow and tools primitive" ... "By the late 1980s and early 1990s, Ada compilers had improved in performance")
- pjmlp 3y agoAnother issue that delayed adoption in regards to GNAT specially was the licence, somehow debatable, similarly to what happened with Qt, or Java implementations.
- jjgreen 3y agoPretty much any job using it will require security clearance ...
- CyberDildonics 3y agoThis is your first comment in 11 months and 1 of only 4 over 10 years. What is great about it? What do you like?
- zogrodea 3y agoIt might be because I have "showdead" enabled but I see that there are many frequent comments from this user when clicking their page. Every comment I see from them seems to be flagged/dead though...
- woodruffw 3y agoI’m glad that domain-limited integer types are called out: I wish more languages had that. At the same time: there’s a reasonable practical argument that both have essentially safe semantics, and that “safer” one is really just the more successful (easier to integrate into existing codebases, more online resources, &c.) one. Rust is (thus far) winning at that.
- okl 3y agoThat feature really helps when you use integers for indexing, e.g., like an enum. Say you are parsing a file format with a type field which can have values 5, 6, 7, you can easily check if that's valid with a single call and lookup something, like a corresponding length in an array without having to translate those field values to array indices first.
- woodruffw 3y agoYep, although Rust manages to get there just fine with sum types and fallible conversion traits.
- jph 3y agoIMHO preconditions and postconditions are a big win for Ada. I missed them in Rust, so wrote the Rust "assertables" crate, which provides runtime assert expressions for a bunch of typical cases such as comparing numbers, strings, lists, IO, etc. Rust code to assert a runtime precondition or postcondition a > b then handle it as you wish: assert_gt_as_result!(a, b) -> Result https://crates.io/crates/assertables https://crates.io/crates/assertables
- mmoskal 3y agoThere is also anyhow::ensure!() (which is more of a requires() but anyhow...)
- saagarjha 3y agoWhy the specialized API, rather than (say) precondition(foo == bar)?
- masklinn 3y agoProbably to get better error messages, same as assert_eq, otherwise you need a procedural macro to take appart the entire expression which is way more complicated and more expensive.
- jph 3y agoMerely because the "assert" wording is more familiar to more Rust developers because it's similar to typical test code, and can create better error messages with details. For what you're asking, the assertables crate has a macro that will handle any condition: assert_as_result!(condition) -> Result And you can alias it as you wish such as: use assertables::assert_as_result as precondition; And now you can write what you're suggesting: precondition(a == b)
- GuB-42 3y agoI wish more languages supported that natively, starting with C and C++. The most typical example, in C, output arguments, passed by pointer, a pattern that I also use in C++ because I find passing by non-const reference error-prone since it is not obvious looking at the calling code that an argument may be modified. But what about NULL? Sometimes it is a good thing that NULL is allowed, sometimes, it doesn't make sense. So again, not obvious. So what to we do? You can document it of course, but the problem is that compilers don't read the docs, and therefore can't tell you if you are doing it wrong. You can play it safe, and design your API so that NULL is always an option, and avoid NULL when using others APIs, but it leads to unnecessary and performance-impacting checks. Preconditions and postconditions would solve that problem: if you pass an argument that can be NULL to a function that doesn't accept NULL, the compiler can warn you. Plus, there is optimization potential, in the same way that C/C++ does with undefined behavior, but this is explicit. You also can also get the choice between safe (runtime checks) or fast (undefined behavior) at compile time. Making it a core feature of the language rather than an extension (like your rust crate) will help compilers and other tools to take full advantage of what it brings.
- charcircuit 3y agoHaving a more expressive type systems does not make a language automatically safer.
- IshKebab 3y agoIn the same way that thicker armour isn't necessarily safer.
- charcircuit 3y agoNo, it is more like having the tools that can technically create better armor does not neccessarily mean you will on average create better armor than someone with tools less capable.
- IshKebab 3y agoOk but when people say "is Ada safer than Rust" they obviously mean when both languages are used by competent people who are familiar with the language. So no, it is not like that.
- charcircuit 3y agoEven competent people make mistakes and not everyone working on the project will be competent in everything.
- IshKebab 3y agoThat's exactly what "safer" means in this context. A safer language is one in which the probability of a competent person making a mistake (that makes it into production) is lower.
- peppermint_gum 3y agoI noticed that many people praising Ada on the internet don't actually know the language. It's odd. Why advocate for a language you don't use? Here are some common giveaways: - "Ada has a garbage collector" - It's optional part of the specification, in practice most compilers don't implement it. - Confusing SPARK (the formal verifier) with Ada, or even claiming that SPARK is now part of the Ada spec. This is simply not true. - Not knowing that contracts are enforced at runtime and they're typically disabled in release builds. - Claiming that Ada is memory safe. Ada doesn't have a borrow checker. Ada doesn't have smart pointers out of the box (unique_ptr is actually unimplementable due to lack of move semantics). Typical non-embedded codebase is full of "new" and "Unchecked_Deallocation", usually wrapped with controlled types, much like C++ RAII.
- deleted 3y ago[deleted]
- comonoid 3y agoA garbage collector was also part of C++ spec from C++11 to C++23.
- eggy 3y ago>>Ada doesn't have smart pointers out of the box I am a novice-intermediate Ada user (and I started with SPARK before moving to just Ada), but a lot of the arguments in favor of Rust mention that "there is a crate for that". I would say you need to compare vanilla Rust "out-of-the-box" with Ada for a fair comparison. Another reason I prefer Ada is because I find it boringly simple like Pascal even though it is verbose, whereas I find Rust very obtuse, and I have a personal bias for array languages and ML languages. I wish Rust were more F#-like.
- masklinn 3y ago> but a lot of the arguments in favor of Rust mention that "there is a crate for that". I would say you need to compare vanilla Rust "out-of-the-box" with Ada for a fair comparison. Smart pointers are vanilla rust shrug. But also, it's pretty fair to mention the availability of crates, because they're easy to integrate, liberally used by the project itself (go browse https://github.com/rust-lang https://github.com/rust-lang and you'll see a number of projects for libraries distributed as crates rather than part of the stdlib), and there's a large breadth of available packages. The internet tells me Alire is a (the?) package manager for Ada, its listing has 373 entries right now (https://alire.ada.dev/crates.html https://alire.ada.dev/crates.html). Simple odds say you're more likely to find a crate for that than an ada package.
- 0x69420 3y agoada has some things that rust doesn't. a lot of them (bounded numbers, pre/post conditions) are really good but do not present a case for writing the category of program rust targets. nor the other way round, really. when the dust settles and hindley-milner types, rank-n types, substructural types, etc, all complete their respective journeys from "weird thing the academics came up with" to "state of the art in hip new language that managed to compellingly package it" to "fact of life", it is my hope that dependent types will follow suit -- something that bridges the ux gap between theorem prover and general-purpose language where anything from ownership and borrowing to refinement types lives under one HOL umbrella and lets you make just about any guarantee you like. i recommend anyone reading follows the f* project
- quag 3y agoFor the curious (as f* is hard to search for): https://fstar-lang.org/ https://fstar-lang.org/
- Buttons840 3y agoOne problem with dependant types is having to write the proofs, but perhaps AI can help with this. The type system can be the world the AI lives in, and we don't have to check the proofs too closely, only know that they proved our high level assertions.
- kaba0 3y agoI would definitely want a CI pipeline that randomly fails depending on what day ChatGPT has (Yeah, I know about temperature, but AIs are dumb as hell especially at logical inference stuff, so I just went with the comment in a satirical way)
- Buttons840 3y agoYou misunderstand. When working with dependent typed languages sometimes you have to prove things. For example, my function might receive a sorted array, but it has to be proved that the array is sorted, otherwise this is a compile time error--remember, all of this is happening at compile time. So, you write the proof using code and check it in with the rest of your code. It's not something that's going to fail randomly, it's just code. If AI wrote the proof, this would be no different than having Copilot fill in some code, it's just code you check into the repo. These proofs often involve writing code, any code, that will pass the type checker. If you can write code, no matter what that code is, and it passes the type checker, the assertion is proved. It's such a well structured problem, "just write code that satisfies these type constraints, any code will do, as long as it type checks", that I think AI might be able to do it quite well. I've commented on this before and it wasn't well received then either. I think most people have never coded in dependently type language and don't appreciate how often you simply want to fill in the holes and connect the dots with any code that type checks. It's been several years since I experimented with dependent types, so I forgot a lot of the details, but I do remember often wanting to just "fill in the gaps", and indeed, there are IDE tools that can often fill in the gaps for you. (Another thing I was surprised to realize about languages with strong type systems is how often there is literally only one possible implementation of a function.)
- onetimeuse92304 3y ago[flagged]
- jjgreen 3y agoWell in theory, honestly, we hacked most of it together with Perl.
- euW3EeBe 3y ago> I roll my eyes every time I hear about yet another programming language for which the biggest invention is that it does not allow null pointers. > It is even worse when a programming language manages to solve an easily preventable problem by creating additional workload on the programmer. What programming languages are you referring to here? Both Rust and Ada do more than disallow nulls, and help solve some non-trivial problems. Of course at the expense of additional constraints, but that's probably unavoidable.
- youerbt 3y ago> Programming languages are tools to get shit done. I, on the other hand, find it baffling that some programmers, despite the fact that programmers generally make computers useful for other people, don't care how computers can be more useful for them. Those guys in the "square wheels comic"[0] are also getting shit done. [0] easy to google
- deleted 3y ago[deleted]
- Kamq 3y ago> don't care how computers can be more useful for them My guess is that the OP doesn't see this as a computer being more useful for them, but instead sees it as being less useful as it requires more work to get the same result. And if you're in a domain where crashes aren't necessarily a problem, or where security isn't a top priority (non-public facing tools often fall into this category), correctness (in the general case) and safety don't automatically map to utility.
- Animats 3y agoIf you don't use the heap, which is common in real-time control, Ada has real advantages. That's what Ada is for, after all.
- archgoon 3y ago[dead]
- fuzztester 3y agoEiffel had design by contract from way back. https://en.m.wikipedia.org/wiki/Eiffel_(programming_language) https://en.m.wikipedia.org/wiki/Eiffel_(programming_language... https://en.m.wikipedia.org/wiki/Design_by_contract https://en.m.wikipedia.org/wiki/Design_by_contract Unfortunately it suffered from some of the same issues as Ada: For a long time, only expensive implementations available, and a somewhat verbose syntax.
- BirAdam 3y agoI’ve used Ada. I’ve not used Rust beyond a few hello world type programs. Personally, I like Ada quite a bit, and I really do like Spark. But I think that Ada and Rust are aiming at similar problems in entirely different ways. One of the key design choices in Ada was to emphasize maintainability. Rust’s answer was to emphasize memory safety. While the Ada compiler does quite a few safety checks, these aren’t part of the spec so that will vary by compiler. I am not sure that direct comparisons between the two languages are entirely useful. Ada is used for things like cruise missiles and jets. Rust is used for things like browsers and reimplementing GNU. Both are important, but they aren’t exactly similar.
- rurban 3y agoEasy to compare: Search the gnat bug tracker for stack overflow: 14 bugs https://gcc.gnu.org/bugzilla/buglist.cgi?quicksearch=Ada%20stack%20overflow https://gcc.gnu.org/bugzilla/buglist.cgi?quicksearch=Ada%20s... Rust: 243 (plus 830 closed) https://github.com/rust-lang/rust/issues?q=is%3Aissue+is%3Aopen+stack+overflow https://github.com/rust-lang/rust/issues?q=is%3Aissue+is%3Ao... Choose by yourself which seems safer
- Smaug123 3y agoCertainly a compelling demonstration that Rust is much more popular than Ada.
- kaba0 3y agoSo I guess the safety belt is also much more dangerous than not having it, as more people have accidents with seatbelts on? Similarly faulty logic.
- xcdzvyn 3y agoWell I've never blown through the stack in Assembly.
- iudqnolq 3y agoBesides the obvious reasons this is an invalid comparison I found the Rust bugs returned by your search quite interesting. For some reason that term seems to disproportionally turn up very poor bug reports. It's mostly compiler crashes caused by weird issues on the reporter's machine. For example: "I cannot reproduce this on rust tarball sources outside our Yocto build environment." Edit: Part of the problem is your search term is `stack overflow` not `"stack overflow"`. Many of your results are issues where the reporter included a stack trace and someone mentioned the word "overflow".
- oglop 3y ago[flagged]
- ajxs 3y agoThe proof of the pudding is in the tasting. I can't find any evidence online that anyone has ever used Rust in software where its correctness needs to be certified, and audited with something like DO-178C. I think that settles the debate. Maybe Rust could be as safe as Ada, once the Rust type system has been proven, and there's a verified compiler. Those things haven't happened yet though, so it's not likely to be used in a safety-critical environment anytime soon. Ada has been used in this area for decades.
- Faaak 3y agoYou might be interested in https://ferrous-systems.com/ferrocene/ https://ferrous-systems.com/ferrocene/, which " is a ISO 26262 (ASIL D) and IEC 61508 (SIL 4) qualified version of the existing open-source compiler, rustc, based on Rust 1.68."
- jeffreygoesto 3y agoYou were one minute faster :). Golf clap.
- jeffreygoesto 3y agoIt is just a matter of time and one important step has been achieved recently. https://ferrous-systems.com/blog/officially-qualified-ferrocene/ https://ferrous-systems.com/blog/officially-qualified-ferroc...
- ajxs 3y agoOh, pardon me. I didn't realise Rust had a qualified compiler already. It looks like this is what Ferrous Systems was working on with AdaCore.
- cpeterso 3y agoDo any languages besides Ada use an identifier naming convention that merges PascalCase and snake_case like Ada_Identifier_Name? Popular languages like Python, Ruby, and Rust already mix both PascalCase and snake_case (for class and function names, respectively), so consistency isn’t the reason. This naming convention avoids acronym capitalization ambiguities and reads more like natural written language. For example, instead of normalizing the inconsistently-capitalized identifier XMLHttpRequest as XMLHTTPRequest, XmlHttpRequest, or xml_http_request, you would use XML_HTTP_Request.
- inamberclad 3y agoI like it quite a lot while reading, but it's a holy hell to keep reaching between shift and underscore. Besides, what do you call an iterator variable? I? i? Idx? Index? Iterator_Index?
- docandrew 3y agoBoth of them are a lot safer than just about everything else, with each having their own strong areas. I think it’s fair to compare the SPARK subset of Ada with the “safe” subset of Rust. Rust has a great story with memory safety though it’s worth noting that SPARK is adding pointer ownership analysis (inspired heavily by the borrow checker, which really is a big deal). In practice, as others mentioned, heap allocation isn’t needed that much with Ada, and passing by reference without needing pointers is common using “in out”. Ada’s contracts and strong type system make it easier to design correct programs - is that “safer”? I don’t know. I wish _both_ languages were in wider use. I really enjoy Ada programming but envy the excitement and community being built around Rust. Hopefully Rust’s popularity leads to more enthusiasm for Ada and the unique correctness and safety advantages it brings. Maybe the next GNAT release will have a “Rust” FFI import mechanism (like it does now for C and Fortran) so Ada code can more easily take advantage of all the great Rust libraries being written.
- blub 3y agoThe “safety” Rust offers is just avoiding C and C++ specific memory access pitfalls, similar to pretty much any mainstream programming language except C and C++. It can also prevent data races, I’ll give it that. The novelty is doing the above at near C and C++ performance levels, not the protection offered. Rust is for the move fast and break things mainstream, where such “safety” is good enough. Ada and SPARK are for safety-critical systems. In other words, it’s playing in a different league.
- armchairhacker 3y agoThere's a solid argument that memory-managed languages like Java are safer than Rust, because although your program can crash, it can't segfault unless you're doing something especially weird. Safe Rust programs can also crash via `panic!`, and unsafe Rust programs can segfault and create wonky UB just like C programs if the safety invariants aren't manually enforced. The safest language would be something like Elm or Datalog, where the type system ensures crashes aren't even possible. But then you just make up your own idea of failure, where instead of crashing the program produces unexpected output, almost like UB.
- dezgeg 3y agoCan't you segfault in Java via stuff in sun.misc.Unsafe?
- pornel 3y agoRust's panic is technically very similar to a Java exception. It does not lead to any unsafety. It throws before executing anything that would be unsafe. Safe Rust can't segfault, unless you're using unsafe code that is buggy, which isn't that much different from using buggy JNI. Beyond just memory safety, Rust has a stronger type system than Java — tracks mutability, ownership, and thread safety that Java doesn't.