3 ms·
> If Rust doesn't give you more and better support in doing that than C does, then it's not really making a difference. It does and if you've been missing that
by couchand 3y ago
> If Rust doesn't give you more and better support in doing that than C does, then it's not really making a difference.
It does and if you've been missing that you've misunderstood this whole discussion. Rust allows you to wrap up some unsafe code in a safe abstraction. You use the type checker to enforce your invariants, such that the unsafe code can be reviewed in isolation.
Rust gives you exactly what you're saying you want. Steve is describing Rust as it is.
- lmm 3y ago> It does and if you've been missing that you've misunderstood this whole discussion. Don't tell it to me, tell it to the person I was replying to.
- couchand 3y agoI believe you said > any nontrivial program will have unsafe somewhere, and unsafe can cause failures arbitrarily far away from the incorrect code But the point I was trying to make is that this claim is facially true but misses the critical context: in idiomatic Rust, the unsafe keyword is not the barrier that enforces integrity of the system. The integrity of the system is enforced by the type checker, the same way it always is. The unsafe annotation alerts the reader that there exists an invariant the compiler can't check. Idiomatic code will have a SAFETY comment above describing the invariant. It should be locally possible to reason about how the type abstraction used to encapaulate truly enforces that invariant. This is what Rust people are talking about when we say wrap unsafe code in a safe abstraction. If we do it right, it's no longer possible for spooky action at a distance. Now you might go and point out the fallibility of humans and all that, and you'd be right, but that's in fact what makes it so valuable to try.