4 ms·

> circle: rigorous memory safety > rust: unsafe { println!("{}", *r1); } Comeon people, if you allow unsafety, you cannot call your language safe. There are s

> circle: rigorous memory safety > rust: unsafe { println!("{}", *r1); } Comeon people, if you allow unsafety, you cannot call your language safe. There are safe system languages, but don't lie and call unsafe languages safe. Partial safety is not full safety.

lpapez 2y ago
Unsafe in Rust is not unsafe in the same sense that C/C++ UB is unsafe. Unsafe in Rust means "soundness cannot be statically verified, the language will insert runtime checks for you and perform a clearly defined action (panic) if they are violated". Much ink has been spilled about "unsafe" in Rust being unfortunately named.
- j16sdiz 2y ago
  No. No. And no. > It is the programmer's responsibility when writing unsafe code to ensure that any safe code interacting with the unsafe code cannot trigger these behaviors. https://doc.rust-lang.org/reference/behavior-considered-undefined.html https://doc.rust-lang.org/reference/behavior-considered-unde... And they transverse > However, violations of these constraints generally will just transitively lead to one of the above problems. https://doc.rust-lang.org/nomicon/what-unsafe-does.html https://doc.rust-lang.org/nomicon/what-unsafe-does.html
- loeg 2y ago
  > Unsafe in Rust is not unsafe in the same sense that C/C++ UB is unsafe. Unsafe in Rust means "soundness cannot be statically verified Right. But as sibling points out, the rest of your sentence is incorrect. The language mostly does not insert additional, runtime checks and you are allowed to create UB-level bad behavior in unsafe blocks.
tialaramex 2y ago
Notice that "unsafe" isn't a magic "off" switch, it's just super powers, things you would otherwise be forbidden from doing are now legal, but things you could have done before have the same behaviour - and if everything in an unsafe block doesn't need super powers you'll get a compiler warning saying the unsafe block you wrote was futile. So, this only does anything interesting if r1 was a raw pointer so that dereferencing it would be prohibited without the unsafe block. If it's just a reference or some smart pointer type then that's fine anyway.

lpapez 2y ago

Unsafe in Rust is not unsafe in the same sense that C/C++ UB is unsafe. Unsafe in Rust means "soundness cannot be statically verified, the language will insert runtime checks for you and perform a clearly defined action (panic) if they are violated". Much ink has been spilled about "unsafe" in Rust being unfortunately named.

j16sdiz 2y ago
No. No. And no. > It is the programmer's responsibility when writing unsafe code to ensure that any safe code interacting with the unsafe code cannot trigger these behaviors. https://doc.rust-lang.org/reference/behavior-considered-undefined.html https://doc.rust-lang.org/reference/behavior-considered-unde... And they transverse > However, violations of these constraints generally will just transitively lead to one of the above problems. https://doc.rust-lang.org/nomicon/what-unsafe-does.html https://doc.rust-lang.org/nomicon/what-unsafe-does.html
loeg 2y ago
> Unsafe in Rust is not unsafe in the same sense that C/C++ UB is unsafe. Unsafe in Rust means "soundness cannot be statically verified Right. But as sibling points out, the rest of your sentence is incorrect. The language mostly does not insert additional, runtime checks and you are allowed to create UB-level bad behavior in unsafe blocks.

tialaramex 2y ago

Notice that "unsafe" isn't a magic "off" switch, it's just super powers, things you would otherwise be forbidden from doing are now legal, but things you could have done before have the same behaviour - and if everything in an unsafe block doesn't need super powers you'll get a compiler warning saying the unsafe block you wrote was futile. So, this only does anything interesting if r1 was a raw pointer so that dereferencing it would be prohibited without the unsafe block. If it's just a reference or some smart pointer type then that's fine anyway.