4 ms·

> There's only one systems-level/non-garbage collected language that provides rigorous memory safety. That's the Rust language. Honest question: what about Ada

> There's only one systems-level/non-garbage collected language that provides rigorous memory safety. That's the Rust language. Honest question: what about Ada? It was specifically designed to be a safe language for critical systems, and for a while was mandated for some military systems. Did the author not consider it, or are its protections just not as expansive as Rust's?

steveklabnik 2y ago
I’m not the author, but there’s a few reasons Ada tends to be forgotten in these discussions: Back when Ada was new, people just didn’t actually like programming in it much. Some did, of course, but many did not. This is the reason the Ada Mandate was abandoned. This led into a situation with a small, walled off community that didn’t really communicate with the outside world much. This has a compounding effect over time. Ada, while designed for safety critical systems, was not actually memory safe until fairly recently. Deallocating memory at runtime wasn’t, and in my understanding, may only be in the presence of SPARK? Hopefully someone can chime in here. Now, that fine for the systems Ada tended to be used for, which often have either no dynamic allocation or a singular allocation at program startup, but for inspiration for other language designs, given that it forgoes a hard problem, it’s not really as useful to those who are trying to solve those problems. This doesn’t mean Ada is useless for inspiration, but for “how do I implement memory safety,” it doesn’t have many unique uses things to offer. None of this means Ada is a bad language, but these are the main contributing factors that I see with regards to your specific question.
- pjmlp 2y ago
  That is the usual Ada outdated image, just like unsafe code blocks in Rust, those Unchecked Deallocation are wrapped in safe calls, and since Ada95 there are controlled types, allowing for RAII patterns. Additionally, it is common to use arenas, and many types can be dynamically stack allocated with a retry operation in case there is not enough space, so that the call can be redone with a smaller size. Memory Management with Ada 2012 from FOSDEM 2016, https://archive.fosdem.org/2016/schedule/event/ada_memory/ https://archive.fosdem.org/2016/schedule/event/ada_memory/ Doesn't go much into SPARK related improvements though, given its date.
  - steveklabnik 2y ago
    Sure, none of that is particularly novel though, so in terms of citing it as something specifically to add to the conversation, there isn't any real reason.
    - quietbritishjim 2y ago
      It was the article author's choice to specifically say there is no safe systems programming language other than Rust. If that is not true then it's worth citing in discussion of the article.
      - steveklabnik 2y ago
        My parent confirmed that deallocating memory is still unsafe, even though there are common usage patterns that help make sure you're doing it correctly.
        pjmlp 2y ago
        Just like using double linked lists in Rust is unsafe, unless special libraries are used, this is no different. Also we aren't talking about Ada83 any longer.
  - roca 2y ago
    How does "redo the call with a smaller size" possibly help you? If you could get by with less memory, you should have asked for less memory in the first place.
    - pjmlp 2y ago
      For some types of applications, it is a doable use case, it is the same as asking how malloc() returning NULL helps.
      - roca 2y ago
        malloc() returning NULL isn't that helpful. Most applications just react to that by aborting, and most applications that don't abort take poorly-tested error-handling paths that often don't work. I don't remember ever seeing an application that reacted by trying the allocation again but requesting less memory. I have seen applications react by pausing and trying the allocation again a few seconds later --- this can be shockingly effective! https://hacks.mozilla.org/2022/11/improving-firefox-stability-with-this-one-weird-trick/ https://hacks.mozilla.org/2022/11/improving-firefox-stabilit...
tialaramex 2y ago
Ada itself doesn't provide you the same guarantees as Safe Rust. You can use SPARK to grant Ada more memory safety capabilities. However as a language (rather than comments which may or may not be ignored by your Ada compiler) SPARK is from 2014, so now we're close to Rust's age. I assume that the totality of SPARK's guarantees would get you to the same place as Rust but I don't know. A big thing which counts against Ada (and SPARK) in practice is that it's not popular. You'll trip over Rust programmers everywhere, two of my friends are getting paid to write Rust, for completely unrelated companies, unrelated reasons, Rust seems like a reasonable fit so those companies picked Rust. You don't see that with Ada and SPARK.
- cardanome 2y ago
  I think Ada not being very popular shows that the need for a memory safe non-garbage collected language is kind of overstated. If there was really that much of a need, people would have flocked to Ada despite its shortcomings. Most people solved the safety problem a long time ago by switching to garbage collected languages. As times go on and garbage collector designs get better while hardware gets beefier you can get away with using a garbage collected language in more and more cases. Case in point golang marketing itself as a system programming language and succeeding, not to even mention even the game dev accepting C# these days. To be clear, there is a niche and need for safe and non-garbadge collected languages and there will always be. I am just saying the niche is much smaller than people might think. I think it is mistake for Rust evangelists to market safety of the killer-feature of the language. Rust is not popular because of the safety but because it lowered the barriers of entry for a new generation of system programmers by providing excellent tooling, error messages and a type system that take at least the lower hanging fruits of the academic functional world. That is all cool stuff beyond the safety circle jerk.
  - burjui 2y ago
    > I think Ada not being very popular shows that the need for a memory safe non-garbage collected language is kind of overstated. It only shows that Ada is very old and verbose.
- 2y ago

steveklabnik 2y ago

I’m not the author, but there’s a few reasons Ada tends to be forgotten in these discussions: Back when Ada was new, people just didn’t actually like programming in it much. Some did, of course, but many did not. This is the reason the Ada Mandate was abandoned. This led into a situation with a small, walled off community that didn’t really communicate with the outside world much. This has a compounding effect over time. Ada, while designed for safety critical systems, was not actually memory safe until fairly recently. Deallocating memory at runtime wasn’t, and in my understanding, may only be in the presence of SPARK? Hopefully someone can chime in here. Now, that fine for the systems Ada tended to be used for, which often have either no dynamic allocation or a singular allocation at program startup, but for inspiration for other language designs, given that it forgoes a hard problem, it’s not really as useful to those who are trying to solve those problems. This doesn’t mean Ada is useless for inspiration, but for “how do I implement memory safety,” it doesn’t have many unique uses things to offer. None of this means Ada is a bad language, but these are the main contributing factors that I see with regards to your specific question.

pjmlp 2y ago
That is the usual Ada outdated image, just like unsafe code blocks in Rust, those Unchecked Deallocation are wrapped in safe calls, and since Ada95 there are controlled types, allowing for RAII patterns. Additionally, it is common to use arenas, and many types can be dynamically stack allocated with a retry operation in case there is not enough space, so that the call can be redone with a smaller size. Memory Management with Ada 2012 from FOSDEM 2016, https://archive.fosdem.org/2016/schedule/event/ada_memory/ https://archive.fosdem.org/2016/schedule/event/ada_memory/ Doesn't go much into SPARK related improvements though, given its date.
- steveklabnik 2y ago
  Sure, none of that is particularly novel though, so in terms of citing it as something specifically to add to the conversation, there isn't any real reason.
  - quietbritishjim 2y ago
    It was the article author's choice to specifically say there is no safe systems programming language other than Rust. If that is not true then it's worth citing in discussion of the article.
    - steveklabnik 2y ago
      My parent confirmed that deallocating memory is still unsafe, even though there are common usage patterns that help make sure you're doing it correctly.
      - pjmlp 2y ago
        Just like using double linked lists in Rust is unsafe, unless special libraries are used, this is no different. Also we aren't talking about Ada83 any longer.
- roca 2y ago
  How does "redo the call with a smaller size" possibly help you? If you could get by with less memory, you should have asked for less memory in the first place.
  - pjmlp 2y ago
    For some types of applications, it is a doable use case, it is the same as asking how malloc() returning NULL helps.
    - roca 2y ago
      malloc() returning NULL isn't that helpful. Most applications just react to that by aborting, and most applications that don't abort take poorly-tested error-handling paths that often don't work. I don't remember ever seeing an application that reacted by trying the allocation again but requesting less memory. I have seen applications react by pausing and trying the allocation again a few seconds later --- this can be shockingly effective! https://hacks.mozilla.org/2022/11/improving-firefox-stability-with-this-one-weird-trick/ https://hacks.mozilla.org/2022/11/improving-firefox-stabilit...

tialaramex 2y ago

Ada itself doesn't provide you the same guarantees as Safe Rust. You can use SPARK to grant Ada more memory safety capabilities. However as a language (rather than comments which may or may not be ignored by your Ada compiler) SPARK is from 2014, so now we're close to Rust's age. I assume that the totality of SPARK's guarantees would get you to the same place as Rust but I don't know. A big thing which counts against Ada (and SPARK) in practice is that it's not popular. You'll trip over Rust programmers everywhere, two of my friends are getting paid to write Rust, for completely unrelated companies, unrelated reasons, Rust seems like a reasonable fit so those companies picked Rust. You don't see that with Ada and SPARK.

cardanome 2y ago
I think Ada not being very popular shows that the need for a memory safe non-garbage collected language is kind of overstated. If there was really that much of a need, people would have flocked to Ada despite its shortcomings. Most people solved the safety problem a long time ago by switching to garbage collected languages. As times go on and garbage collector designs get better while hardware gets beefier you can get away with using a garbage collected language in more and more cases. Case in point golang marketing itself as a system programming language and succeeding, not to even mention even the game dev accepting C# these days. To be clear, there is a niche and need for safe and non-garbadge collected languages and there will always be. I am just saying the niche is much smaller than people might think. I think it is mistake for Rust evangelists to market safety of the killer-feature of the language. Rust is not popular because of the safety but because it lowered the barriers of entry for a new generation of system programmers by providing excellent tooling, error messages and a type system that take at least the lower hanging fruits of the academic functional world. That is all cool stuff beyond the safety circle jerk.
- burjui 2y ago
  > I think Ada not being very popular shows that the need for a memory safe non-garbage collected language is kind of overstated. It only shows that Ada is very old and verbose.
2y ago