6 ms·

>Its language characteristics make it trivial to accidentally introduce memory safety issues resulting in undefined behavior or security vulnerabilities. I wor

>Its language characteristics make it trivial to accidentally introduce memory safety issues resulting in undefined behavior or security vulnerabilities. I worked for a space-related defense contractor. They are using MISRA C, and everything is very thoroughly designed, documented, and tested. I haven’t seen any research into bugs in safety critical systems caused by memory safety issues, but I think that in practice it is very possible to write memory safe C code if you follow industry standards.

pylua 2y ago
Just curious: do you see any issues with concurrency or anything else rust would help with, or is it domain knowledge related issues?
- steveklabnik 2y ago
  I am answering this comment from the audience at https://oxidizeconf.com/ https://oxidizeconf.com/ There is a growing number of people and organizations that do see Rust as bringing advantages in this area. That said, your parent isn’t wrong that the safety critical space has developed numerous ways of mitigating the risk of writing software, no matter what language it’s written in. But that doesn’t mean that language is irrelevant.
smaddox 2y ago
Skimming MISRA C, it seems to be a collection of either extremely limiting or ineffectual directives. An example of each: > Dir 4.12 Dynamic memory allocation shall not be used > Rule 2.2 There shall be no dead code https://github.com/sakura1083841400/MISRA-C/blob/main/MISRA%20C%202012%20Guidelines%20for%20the%20use%20of.pdf https://github.com/sakura1083841400/MISRA-C/blob/main/MISRA%... This provides nothing approaching the guarantees of safe Rust, as far as I can tell.
- spaceywilly 2y ago
  Not sure what you’re getting at. We take those rules and use a static analysis tool (LDRA) to prove they are met. You can write unsafe code in any language.
- steveklabnik 2y ago
  See also https://github.com/PolySync/misra-rust/blob/master/MISRA-Rules.md https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul...
- hgs3 2y ago
  I wouldn't dismiss MISRA C so quickly as its guidelines may prove useful when deriving best practices for unsafe Rust.

pylua 2y ago

Just curious: do you see any issues with concurrency or anything else rust would help with, or is it domain knowledge related issues?

steveklabnik 2y ago
I am answering this comment from the audience at https://oxidizeconf.com/ https://oxidizeconf.com/ There is a growing number of people and organizations that do see Rust as bringing advantages in this area. That said, your parent isn’t wrong that the safety critical space has developed numerous ways of mitigating the risk of writing software, no matter what language it’s written in. But that doesn’t mean that language is irrelevant.

smaddox 2y ago

Skimming MISRA C, it seems to be a collection of either extremely limiting or ineffectual directives. An example of each: > Dir 4.12 Dynamic memory allocation shall not be used > Rule 2.2 There shall be no dead code https://github.com/sakura1083841400/MISRA-C/blob/main/MISRA%20C%202012%20Guidelines%20for%20the%20use%20of.pdf https://github.com/sakura1083841400/MISRA-C/blob/main/MISRA%... This provides nothing approaching the guarantees of safe Rust, as far as I can tell.

spaceywilly 2y ago
Not sure what you’re getting at. We take those rules and use a static analysis tool (LDRA) to prove they are met. You can write unsafe code in any language.
steveklabnik 2y ago
See also https://github.com/PolySync/misra-rust/blob/master/MISRA-Rules.md https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul...
hgs3 2y ago
I wouldn't dismiss MISRA C so quickly as its guidelines may prove useful when deriving best practices for unsafe Rust.