5 ms·

What kind of solution would you propose to folks like your boss? One positive aspect I see about "rewrite it in Rust" is that you can to some degree expect a r

What kind of solution would you propose to folks like your boss? One positive aspect I see about "rewrite it in Rust" is that you can to some degree expect a random Rust project to not leak and crash and expose vulnerabilities quite as much as a random C++ project. It's silly, but "written in Rust" acts somewhat as a badge of safety and performance, whereas "written in Java" and "written in C++" each only carry one of the two. Of course, developer skill is also huge. You can write slow Rust code or fast Java code, yadda yadda.

CraigJPerry 3y ago
>> What kind of solution would you propose to folks like your boss? How do you want to play this boss? I can see you’re focussing more on the bigger picture and the code is just a means to an end, given that, how about you delegate technical leadership on the codebase to me to let you focus on the product & commercial aspects? If no - maybe words come back to the effect of “it’s my pet/child, how very dare you” yadda yadda - then I can’t see a happy path beyond “thanks for the opportunity, all the best for the future” but there’s certainly room for many mediocre outcomes short of parting ways if that’s preferred. If yes - “hey, we don’t have infinite money and we prob can’t afford to hire the help to do this to a gold standard so how about we agree these commercial milestones (once change delivery falls below X days on average, or once feature Y that you always wanted lands in prod, or once the defect rate drops below Z per week etc etc) - I get bonus $$$”
Const-me 3y ago
> What kind of solution would you propose to folks like your boss? Rewrite it in C#. It’s safer than Rust, because VM. Both standard and third party libraries are often way better. With modern versions of the language, GC allocations are avoidable if that’s what needed for performance reasons. C interop is equally simple.
- pjmlp 3y ago
  Not necessarily VM, depending on how it gets deployed.
- tuna74 3y ago
  Could you expand on how to avoid using GC in C#?
  - pjmlp 3y ago
    Value types (structs), stack allocated arrays, spans, native memory allocation, arenas. You can also enable the warnings/errors that complain about missing using declarations for class and structs with the Dispose pattern.
  - Const-me 3y ago
    Don’t create new objects, instead use stack and/or unmanaged heap. This reduces the expressive power of the language, for example LINQ from the standard library is probably out because based on the delegates which require memory allocations. Still, the language is very usable even without GC allocations. For example, that library re-implements a subset of ffmpeg for Raspberry Pi4 running 32-bit Linux, with no memory allocations in runtime: https://github.com/Const-me/Vrmac/tree/master/VrmacVideo https://github.com/Const-me/Vrmac/tree/master/VrmacVideo
- dequan 3y ago
  C# is not more safe than Rust is and falls to prevent null pointer exceptions and modified collection exceptions.
  - Const-me 3y ago
    > C# is not more safe than Rust By design, Rust requires unsafe code to implement any non-trivial data structures (except trivial POD types). This applies to both Rust standard library, and third-party crates. The issue is not a theory, security bugs actually happened in reality. Here’s an example about the Rust standard library: https://shnatsel.medium.com/how-rusts-standard-library-was-vulnerable-for-years-and-nobody-noticed-aebf0503c3d6 https://shnatsel.medium.com/how-rusts-standard-library-was-v... By contrast, thanks to the VM and the GC, C# allows to implement very complicated data structures without any unsafe code or unmanaged interop. The standard library is also implemented in idiomatic memory-safe subset of the language. For example, here’s the hash map: https://source.dot.net/#System.Private.CoreLib/src/libraries/System.Private.CoreLib/src/System/Collections/Generic/Dictionary.cs https://source.dot.net/#System.Private.CoreLib/src/libraries... > falls to prevent null pointer exceptions and modified collection exceptions Yes indeed, but these exceptions are very unlikely to cause security bugs in the software.
    - dequan 3y ago
      The entire JIT, garbage collector and most of the C#'s VM are all implemented in C++. This has caused various issues in the past which are exploitable from managed code. The amount of unsafe code used to implement C# vastly outweighs the amount in Rust's standard library.
      - Const-me 3y ago
        > The amount of unsafe code used to implement C# vastly outweighs the amount in Rust's standard library. According to bing.com chat, https://github.com/dotnet/runtime https://github.com/dotnet/runtime has 3.5M LOC, and https://github.com/rust-lang/rust https://github.com/rust-lang/rust has 6M LOC. The right panel of https://github.com/dotnet/runtime https://github.com/dotnet/runtime says 80% of the .NET runtime is written in C#. This makes me wonder, do you happen to have a link for your “vastly outweighs” statement?
usrusr 3y ago
That example is really difficult, because between the lines it sounds like it has been working sufficiently well despite the cowboy style, substituting methodical error-avoidance with that special kind of brilliance of super deep code knowledge and remembering all the pitfalls. Very difficult situation. Regarding "rewrite in Rust", I believe that it's a smaller part of the appeal of Rust than it appears based on the amount of code actually written: the main excitement is from people who never really ventured from heap+gc languages into manual memory management but who love the idea of being able to write gc-less native code. And many of them would rather write it slowly, one borrow-check at a time, than with all the memory bugs they created dipping their feet in naive C/++. Those people rarely write much Rust, but their excitement infects some in malloc/free land and for them a rewrite is super attractive because it skips the entire explorative part of software development that is really not the strong point of Rust. (yes, this is pure projection, not only was I describing what draws me to Rust, I also failed to pick up on the codebase of my previous boss, too much "how can we make this entire thing less slow and error prone" and too little "cram in requirement X, even if it might turn out to become requirement Z because it pushed the codebase over the edge to terminal unmaintainability")
- zozbot234 3y ago
  You can do exploratory programming in Rust, it's just heavy on boilerplate code such as .clone() and Rc<RefCell<>> which would be avoided when writing more idiomatically. Rust even includes support for dynamically typed references and downcasting via the Any trait. It's not as dynamic as Python/Ruby/JS etc. but it's not that far off either.
- they4kman 3y ago
  > the entire explorative part of software development that is really not the strong point of Rust This is what keeps me orbiting but never quite landing on Rust. Things I'm pretty damn sure are safe come back red-stamped, and once I've painted things the way Rust deigns, I find I've lost my appetite. When desire finally returns, I find the fixes I've made to enable compilation also disallow the changes I wanted in the first place. For all its faults and runtime bloat, I find myself going for Go on new things I would've attempted in Rust before. Though, I've never tried Zig; I wonder how that is...
whatyesaid 3y ago
How is a software written in Java having less assurances in terms of leaks/crashes etc compared to Rust? All Rust gives you is a borrow checker that isn't very smart, but means you don't need GC/VM, so you gain a bit of performance compared to Java. But if it's not software that needs to go fast, then Rust is not adding anything for you. And if you considered Java to begin with you probably don't need top tier performance.
- zozbot234 3y ago
  The most notable advantage of Rust compared to GC languages is low and stable memory use and predictable performance, that will not generally drop due to some random GC pause. Both of these can be of interest even wrt. software that doesn't "need to go fast" in any absolute sense.
  - fiddlerwoaroof 3y ago
    This is a persistent myth that’s only true if your performance model requires persistent latency and, even then, only if you’re careful to pay attention to how much is freed or allocated as you change scopes. The lifetime tracking features of Rust’s type system have non-negligible impacts on the sorts of abstractions you can make.
    - zozbot234 3y ago
      Sure, there is one abstraction that effectively requires GC, namely a general graph of spaghetti references where you can't possibly predict in advance or "pay attention" to" how much is freed or allocated as you change scopes". Many GOFAI problems look like that which is why GC was initially developed in the context of LISP, the most prominent language for GOFAI. But for most real-world programs you can do vastly better than that.
- riwsky 3y ago
  The parent didn’t suggest Java is less safe; their point is “Java is safe; C++ is fast; Rust is both” and they just phrased it unclearly
Neikius 3y ago
Java is slow is a really old myth. It was once upon a time. Ofc there are caveats but looking at your average developer ... You will be fine. On the other hand I would forbid an average developer the use of c/c++ and similar. It is just not worth it.

CraigJPerry 3y ago

>> What kind of solution would you propose to folks like your boss? How do you want to play this boss? I can see you’re focussing more on the bigger picture and the code is just a means to an end, given that, how about you delegate technical leadership on the codebase to me to let you focus on the product & commercial aspects? If no - maybe words come back to the effect of “it’s my pet/child, how very dare you” yadda yadda - then I can’t see a happy path beyond “thanks for the opportunity, all the best for the future” but there’s certainly room for many mediocre outcomes short of parting ways if that’s preferred. If yes - “hey, we don’t have infinite money and we prob can’t afford to hire the help to do this to a gold standard so how about we agree these commercial milestones (once change delivery falls below X days on average, or once feature Y that you always wanted lands in prod, or once the defect rate drops below Z per week etc etc) - I get bonus $$$”

Const-me 3y ago

> What kind of solution would you propose to folks like your boss? Rewrite it in C#. It’s safer than Rust, because VM. Both standard and third party libraries are often way better. With modern versions of the language, GC allocations are avoidable if that’s what needed for performance reasons. C interop is equally simple.

pjmlp 3y ago
Not necessarily VM, depending on how it gets deployed.
tuna74 3y ago
Could you expand on how to avoid using GC in C#?
- pjmlp 3y ago
  Value types (structs), stack allocated arrays, spans, native memory allocation, arenas. You can also enable the warnings/errors that complain about missing using declarations for class and structs with the Dispose pattern.
- Const-me 3y ago
  Don’t create new objects, instead use stack and/or unmanaged heap. This reduces the expressive power of the language, for example LINQ from the standard library is probably out because based on the delegates which require memory allocations. Still, the language is very usable even without GC allocations. For example, that library re-implements a subset of ffmpeg for Raspberry Pi4 running 32-bit Linux, with no memory allocations in runtime: https://github.com/Const-me/Vrmac/tree/master/VrmacVideo https://github.com/Const-me/Vrmac/tree/master/VrmacVideo
dequan 3y ago
C# is not more safe than Rust is and falls to prevent null pointer exceptions and modified collection exceptions.
- Const-me 3y ago
  > C# is not more safe than Rust By design, Rust requires unsafe code to implement any non-trivial data structures (except trivial POD types). This applies to both Rust standard library, and third-party crates. The issue is not a theory, security bugs actually happened in reality. Here’s an example about the Rust standard library: https://shnatsel.medium.com/how-rusts-standard-library-was-vulnerable-for-years-and-nobody-noticed-aebf0503c3d6 https://shnatsel.medium.com/how-rusts-standard-library-was-v... By contrast, thanks to the VM and the GC, C# allows to implement very complicated data structures without any unsafe code or unmanaged interop. The standard library is also implemented in idiomatic memory-safe subset of the language. For example, here’s the hash map: https://source.dot.net/#System.Private.CoreLib/src/libraries/System.Private.CoreLib/src/System/Collections/Generic/Dictionary.cs https://source.dot.net/#System.Private.CoreLib/src/libraries... > falls to prevent null pointer exceptions and modified collection exceptions Yes indeed, but these exceptions are very unlikely to cause security bugs in the software.
  - dequan 3y ago
    The entire JIT, garbage collector and most of the C#'s VM are all implemented in C++. This has caused various issues in the past which are exploitable from managed code. The amount of unsafe code used to implement C# vastly outweighs the amount in Rust's standard library.
    - Const-me 3y ago
      > The amount of unsafe code used to implement C# vastly outweighs the amount in Rust's standard library. According to bing.com chat, https://github.com/dotnet/runtime https://github.com/dotnet/runtime has 3.5M LOC, and https://github.com/rust-lang/rust https://github.com/rust-lang/rust has 6M LOC. The right panel of https://github.com/dotnet/runtime https://github.com/dotnet/runtime says 80% of the .NET runtime is written in C#. This makes me wonder, do you happen to have a link for your “vastly outweighs” statement?

usrusr 3y ago

That example is really difficult, because between the lines it sounds like it has been working sufficiently well despite the cowboy style, substituting methodical error-avoidance with that special kind of brilliance of super deep code knowledge and remembering all the pitfalls. Very difficult situation. Regarding "rewrite in Rust", I believe that it's a smaller part of the appeal of Rust than it appears based on the amount of code actually written: the main excitement is from people who never really ventured from heap+gc languages into manual memory management but who love the idea of being able to write gc-less native code. And many of them would rather write it slowly, one borrow-check at a time, than with all the memory bugs they created dipping their feet in naive C/++. Those people rarely write much Rust, but their excitement infects some in malloc/free land and for them a rewrite is super attractive because it skips the entire explorative part of software development that is really not the strong point of Rust. (yes, this is pure projection, not only was I describing what draws me to Rust, I also failed to pick up on the codebase of my previous boss, too much "how can we make this entire thing less slow and error prone" and too little "cram in requirement X, even if it might turn out to become requirement Z because it pushed the codebase over the edge to terminal unmaintainability")

zozbot234 3y ago
You can do exploratory programming in Rust, it's just heavy on boilerplate code such as .clone() and Rc<RefCell<>> which would be avoided when writing more idiomatically. Rust even includes support for dynamically typed references and downcasting via the Any trait. It's not as dynamic as Python/Ruby/JS etc. but it's not that far off either.
they4kman 3y ago
> the entire explorative part of software development that is really not the strong point of Rust This is what keeps me orbiting but never quite landing on Rust. Things I'm pretty damn sure are safe come back red-stamped, and once I've painted things the way Rust deigns, I find I've lost my appetite. When desire finally returns, I find the fixes I've made to enable compilation also disallow the changes I wanted in the first place. For all its faults and runtime bloat, I find myself going for Go on new things I would've attempted in Rust before. Though, I've never tried Zig; I wonder how that is...

whatyesaid 3y ago

How is a software written in Java having less assurances in terms of leaks/crashes etc compared to Rust? All Rust gives you is a borrow checker that isn't very smart, but means you don't need GC/VM, so you gain a bit of performance compared to Java. But if it's not software that needs to go fast, then Rust is not adding anything for you. And if you considered Java to begin with you probably don't need top tier performance.

zozbot234 3y ago
The most notable advantage of Rust compared to GC languages is low and stable memory use and predictable performance, that will not generally drop due to some random GC pause. Both of these can be of interest even wrt. software that doesn't "need to go fast" in any absolute sense.
- fiddlerwoaroof 3y ago
  This is a persistent myth that’s only true if your performance model requires persistent latency and, even then, only if you’re careful to pay attention to how much is freed or allocated as you change scopes. The lifetime tracking features of Rust’s type system have non-negligible impacts on the sorts of abstractions you can make.
  - zozbot234 3y ago
    Sure, there is one abstraction that effectively requires GC, namely a general graph of spaghetti references where you can't possibly predict in advance or "pay attention" to" how much is freed or allocated as you change scopes". Many GOFAI problems look like that which is why GC was initially developed in the context of LISP, the most prominent language for GOFAI. But for most real-world programs you can do vastly better than that.
riwsky 3y ago
The parent didn’t suggest Java is less safe; their point is “Java is safe; C++ is fast; Rust is both” and they just phrased it unclearly

Neikius 3y ago

Java is slow is a really old myth. It was once upon a time. Ofc there are caveats but looking at your average developer ... You will be fine. On the other hand I would forbid an average developer the use of c/c++ and similar. It is just not worth it.