6 ms·

That sounds ... hard. Especially as idiomatic Rust as written by skilled programmers looks nothing like C, and most interesting code is written in C++ anyway.

That sounds ... hard. Especially as idiomatic Rust as written by skilled programmers looks nothing like C, and most interesting code is written in C++ anyway. Isn't it equivalent to statically determining the lifetimes of all allocations in the C program, including those that are implemented using custom allocators or which cross into proprietary libraries? There's been a lot of research into this sort of thing over the years without much success. C/C++ programs can do things like tie allocation lifetimes to what buttons a user clicks, without ref counting or other mechanisms to ensure safety. It's not a good idea, but, they can do it. The other obvious problem with trying to write such a static analysis is that the programs you're analyzing are by definition buggy and the lifetimes might not make sense (if they did, they wouldn't have memory safety holes and wouldn't need to be replaced). The only research I've seen on this problem of statically detecting what lifetimes should be does assume the code being analyzed is actually correct to begin with. I guess you could try and aim for a program that detects where lifetimes can't be worked out and asks the developer for help though.

mattgreenrocks 2y ago
Projects are termed DARPA-hard for a reason.
woodruffw 2y ago
It's very hard; DARPA likes to fund hard things[1] :-). This isn't, however, DARPA's first foray into automatic program translation, or even automatic translation into Rust[2]. [1]: https://www.urbandictionary.com/define.php?term=DARPA%20hard https://www.urbandictionary.com/define.php?term=DARPA%20hard [2]: https://c2rust.com/ https://c2rust.com/
- the_snooze 2y ago
  DARPA is basically a state-sponsored VC that optimizes for completely different things. Instead of looking for 100x financial returns, they want technical advantages for the United States. The "moat" is the hardness of developing and operationalizing those technologies first.
  - woodruffw 2y ago
    DARPA's commercialization track record is decidedly mixed, so the VC comparison is unexpectedly apt :-) (But yes: DARPA's mandate is explicitly to discover and develop the next generation of emerging technologies for military use.)
    - pfdietz 2y ago
      Decades ago, as my father explained to me, ARPA (no "D" at that time) was happy if 1% of their projects went all the way through to successful deployment. If they had a higher success rate it would mean they weren't aiming high enough.
    - VikingCoder 2y ago
      > DARPA's commercialization track record is decidedly mixed... If you count my number of attempts, sure. If you count by impact, it's hard to come up with many things more impactful than the Internet...?
      - woodruffw 2y ago
        Yeah, I meant by number. But also: ARPA didn't commercialize the Internet! They explicitly refused to commercialize it; commercialization only happened after an Act of Congress induced interconnections between NSFNET and commercial networks.
  - deleted 2y ago
    [deleted]
  - mburns 2y ago
    To be pedantic, In-q-tel is the literal state-sponsored VC. DARPA is a step closer to traditional research labs but there is obviously some overlap. https://en.wikipedia.org/wiki/In-Q-Tel https://en.wikipedia.org/wiki/In-Q-Tel
    - throwup238 2y ago
      > DARPA is a step closer to traditional research labs but there is obviously some overlap. It's more like the NSF but focused on commercial grantees with project management thrown on top to orchestrate everything. The really unique part is how much independence each program manager has and the term limits that prevent empire building.
- fsckboy 2y ago
  in this case it seems to me the hard task that DARPA has chosen is to get me to forget how much they spent on pushing Ada.
  - woodruffw 2y ago
    I can't find any clear references to DARPA (or ARPA) being involved in Ada's development. It was a DoD program but, well, the DoD is notoriously large and multi-headed. (But even if DARPA was involved in Ada: I think it's clear, at this point, that Ada has been a resounding success in a small number of domains without successfully breaking into general-purpose adoption. I don't have a particular value judgment associated with that, but from a strategic perspective it makes a lot of sense for DARPA to focus program analysis research on popular general-purpose languages -- there's just more labor and talent available.)
    - indolering 2y ago
      Too lazy to look it up, but I'm pretty sure DARPA was involved and certain that DoD contracta prioritized ADA for a long time.
      - rerdavies 2y ago
        Too bored to pass up a challenge to refute somebody who is too lazy to look it up. I looked it up. DARPA was not involved.
  - reaperducer 2y ago
    in this case it seems to me the hard task that DARPA has chosen is to get me to forget how much they spent on pushing Ada. You hate jumbo jets, high-speed trains, air traffic control, and satellites?
    - 9659 2y ago
      Do you know what fear is? Getting in an airplane where the flight controls use NPM.
01HNNWZ0MV43FF 2y ago
Can't most c++ be machine-lowered to C?
- pjmlp 2y ago
  Yes, that is after all how C++ started. How good the resulting performance would be like, that is another matter.
- woodruffw 2y ago
  Lowering is typically easier than lifting (or brightening). When you lower, you can erase higher-level semantics that aren't relevant; when you lift, you generally want to compose lower-level program behaviors into their idiomatic (and typically safer) equivalent.
childintime 2y ago
Hard for humans. But it's DARPA, is it hard for AI? Image classification used to be hard also, today cars drive themselves. I'd say it's good timing.
- childintime 2y ago
  In my experience claude.ai has near perfect grasp of what a program (that fits its window) is written to do. It can already make a program in another language that can do the same. What this means is that the cost of a full rewrite is going to come down dramatically over the next few years. This is an excellent example of government action I like to see, as it isn't about favoritism or the swamp dynamics. Just provide a target, a bounty and no or low barriers to entry. This challenge does push Rust out in front of everybody. That's a mixed blessing. I hope this challenge gets modified to not specify the target language, but instead the requirement of memory and type safety. Rust is likely an intermediate stop on the way to something better, and it shouldn't matter if that language is called Rust 2.0 or something else.
- mike_hearn 2y ago
  Well, Claude 3.5 can do translation from one language to another in a fairly competent manner if the languages are close enough. I've used it for that task myself with success (Java -> JavaScript). But, this isn't just about rewriting code from one language to another. It's about reverse engineering complex information out of the code, which may not be immediately visible in it, and then finding a way to make it "safe" according to Rust's type system. Where's the training data for that? It'd be really hard even for skilled humans. Personally I think the most pragmatic way to make C/C++ memory safe quicker is one of two approaches: 1. Incrementally. Make std::vector[] properly bounds checked (still not done even in chrome!), convert allocations to allocations that know their own size and do bounds checking e.g. https://issues.chromium.org/issues/40285824 https://issues.chromium.org/issues/40285824 2. Or, go the whole hog and use runtime techniques like garbage collection and runtime bounds checks. A good example of approach (2) is Managed Sulong, which extends the JVM to execute LLVM bitcode directly whilst exposing to the C/C++/FORTRAN a virtualized Linux syscall interface. The whole piece of code can be sandboxed with permissions, and memory safety errors are caught at runtime. The compiler tries to optimize out as many bounds checks as possible. The interesting thing about this approach is it doesn't require big changes to the source code (as long as it's already been ported to Linux), which means the work of making something safe can be done by teams independent of the original authors. In practice "rewrite it in Rust" will usually mean a fork, which introduces lots of complicated technical, cultural and economic issues. Managed Sulong is also a research project and has a bunch of problems to solve, for instance it needs to lose the JITC dependency and go fully AOT compiled (doable, there's no theoretical issue with it and much of the needed infra already exists). And performance/memory usage can always be improved of course, it regresses vs the original C. But those are "just" systems engineering problems, not rewrite-the-world and solve-static-analysis problems. Disclosure: I do work part time at Oracle Labs which developed Managed Sulong, but I don't work on it.
sam0x17 2y ago
speaking of hard, the DOE actually funds a project that has been around for 20+ years now (ROSE) that involves (among other things) doing static analysis on and automatically translating between C/C++/Cuda and even high level languages like Python as well as HPC variants of C/C++. They have a combined AST that supports all of those languages with the same set of node types essentially. Quite cool. I got to work on it when I was an intern at Livermore, summer of 2014. and it's open source as well! http://rosecompiler.org/ROSE_HTML_Reference/index.html http://rosecompiler.org/ROSE_HTML_Reference/index.html
- andrewflnr 2y ago
  > a combined AST that supports all of those languages with the same set of node types essentially. I can't believe that works at all. I'll take a look for sure.
  - sam0x17 2y ago
    Most of what they use it for is static analysis, but the funding comes from its ability to translate old simulation code to HPC-ready code. I think they even support fortran IIRC
- seren 2y ago
  I have already seen legacy projects that were designed using Rational Rose, but for some reason I thought it was only a commercial name, not an actual system. Thanks, I learned something today !
  - andrewflnr 2y ago
    Your first instinct was more correct, that's definitely a different thing. :) https://en.wikipedia.org/wiki/IBM_Rational_Rose https://en.wikipedia.org/wiki/IBM_Rational_Rose
jandrese 2y ago
I have to think the approach will be something like "AI summarizes the features of the program into some kind of technical language, then the AI synthesizes Rust code that covers the same feature set". It would be most interesting if the approach was not to feed the program the original program but rather the manual for the program. That said it's rare that a manual captures all of the nuances of the program so a view into the source code is probably necessary, at least for getting the ground truth.
- munificent 2y ago
  More like: "AI more or less sort of summarizes the features of the program into some approximate kind of technical language, then the AI synthesizes something not too far from Rust code that hopefully covers aspirationally the same feature set".
  - trealira 2y ago
    Ghidra, which is decompilation software, already manages to produce almost-valid C from assembly, and it does so without AI. I know nothing about how it works, but just from that, I'm guessing that producing almost-valid Rust from C code would be a simpler problem to solve.
- ip26 2y ago
  In theory, a codebase is a language precisely describing a program. The same program can be described in other languages. So that’s what you’re asking the LLM to do, in the same way you can describe a flower in either English or Spanish.
downrightmike 2y ago
If the IRS could have more timely funding, all their Cobol would be translated to Java by now
- psunavy03 2y ago
  COBOL migrations are tar pits of replicating 40+ years of undocumented niche business logic for a given field, edge cases included, that was "commonly understood" by people who are now retired or dead. Don't get your hopes up.
  - pjmlp 2y ago
    MicroFocus has COBOL compilers for Java and .NET, as do other COBOL vendors still in business. Usually the biggest issue, is that most of the porting attempts don't start there, rather they go for the rewritte from scratch, and lets not pay the licenses for those cross-compilers.
the8472 2y ago
Write tests for your C code. Run c2rust (mechanical translation), including the tests. Let a LLM/MCTS/verifier loop go to town. Verifier here means it passes compiler checks, tests, santiziers and miri. Additional training data can be generated by running mrustc or by inlining unsafe code (from std/core/leaf crates) into safe code and running semantics-preserving mechanical refactorings on the code. This can be closer to AlphaProof than ChatGPT
- astrange 2y ago
  You could already use ASAN + UBSan, or Frama-C.
  - the8472 2y ago
    I did mention using sanitizers in the verification step of the optimization loop. The optimization goal here would be reducing the lines of `unsafe` while preserving program semantics.
- TestingWithEdd 2y ago
  Essentially neural program synthesis
rectang 2y ago
I have to imagine that in the general case it will be a translation to unsafe Rust, with occasional isolated leaf nodes being translated to safe Rust. If you think it's hard wrestling with the borrow checker, just imagine how much harder it is to write automatic translation to borrow-checker-approved code that accounts for all the possible program space of C and all it's celebrated undefined behavior. A classic problem of writing compilers is that the space of valid programs is much larger than the space of programs which will compile. A quick web search reveals some other efforts, such as c2rust [1]. I wonder how TRACTOR differs. [1] https://github.com/immunant/c2rust https://github.com/immunant/c2rust
- Someone 2y ago
  > have to imagine that in the general case it will be a translation to unsafe Rust, with occasional isolated leaf nodes being translated to safe Rust. That’s not what they are aiming for. FTA: “The goal is to achieve the same quality and style that a skilled Rust developer would produce” > just imagine how much harder it is to write automatic translation to borrow-checker-approved code that accounts for all the possible program space of C and all it's celebrated undefined behavior Nitpick: undefined behavior gives the compiler leeway in deciding what a program does, so the more undefined behavior a C program invokes, the easier it is to translate its code to rust. (Doing that translation in such a way that the behavior remains what gcc, clang or “most C compilers” do may be harder, but I’m not sure of that)
  - rectang 2y ago
    > undefined behavior gives the compiler leeway in deciding what a program does, so the more undefined behavior a C program invokes, the easier it is to translate its code to rust. That's the kind of language lawyer approach that caused a rebellion in the last decade amongst C programmers against irresponsible compiler optimizations. "Who cares if your program actually works as intended? My optimization is legal according to the standard, it's your program that's written to exploit loopholes". I don't see any evidence that that's the attitude being taken by TRACTOR — I sure hope it isn't. But hell, even if the result is unreliable in practice, I suppose that if somebody gets to claim "it works" then the incentives are aligned to produce garbage.
kragen 2y ago
presumably dan wouldn't have gotten darpa funding if it were obviously feasible, and success wouldn't give him anything publishable academically
- dgacmu 2y ago
  Just to be clear to others, Dan is the darpa PM on this - he convinced darpa internally it was worth funding other people to do the work, so he himself / his research group won't be doing this work. He's on leave from Rice for a few years to be a PM at DARPA's I2O. And while DARPA doesn't directly care about research publications as an outcome, there's certainly a publishable research component to this, as well as a lot of lower papers-per-$ engineering and validation work. A lot of the contracts they hand out end up going to some kind of contractor prime (BBN, Raytheon, that kind of company) with one or more academic subs. The academic subs publish.
  - kragen 2y ago
    thank you for the correction; I didn't realize he was the darpa pm what you describe is exactly my experience as a darpa performer (on a program which dan is apparently now the pm for!)
elromulous 2y ago
> and most interesting code is written in C++ anyway. You're just asking for people to bring out their pitchforks :P
dlenski 2y ago
Man, I want to upvote this but… > most interesting code is written in C++ anyway. Really?! The Linux kernel is a _pretty enormous_ counterexample, as are many of the userland tools of most desktop Linux distros. I am also a key developer of an entirely-written-in-C tool which I'd venture that [a large fraction of desktop Linux users in corporate environments use on a regular basis](https://gitlab.com/openconnect/openconnect https://gitlab.com/openconnect/openconnect).
- mike_hearn 2y ago
  The refusal to use C++ in Linux isn't entirely rational. Nobody else makes that decision. Other kernels are a mix of C and C++ (macOS/iOS, Windows, even hobby operating systems like SerenityOS). Then you get into stuff that's not kernels and the user-spaces are again mostly all C++. The few exceptions that exist are coming out of the 90s UNIX culture, stuff like Apache or nginx. Beyond that it's all C++ or managed languages.
  - dlenski 2y ago
    > The refusal to use C++ in Linux isn't entirely rational. Whether or not the decision not to use C++ is good or bad, rational or irrational, what is the relevance? The point is that the Linux kernel is technologically interesting and innovative, under very active development, and it's written in C. > The few exceptions that exist are coming out of the 90s UNIX culture, stuff like Apache or nginx. Beyond that it's all C++ or managed languages. I literally just told you about a software project to which I contribute, which thousands of people and organizations use, which is written in C. Also, it wasn't written in the ’90s.

mattgreenrocks 2y ago

Projects are termed DARPA-hard for a reason.

woodruffw 2y ago

It's very hard; DARPA likes to fund hard things[1] :-). This isn't, however, DARPA's first foray into automatic program translation, or even automatic translation into Rust[2]. [1]: https://www.urbandictionary.com/define.php?term=DARPA%20hard https://www.urbandictionary.com/define.php?term=DARPA%20hard [2]: https://c2rust.com/ https://c2rust.com/

the_snooze 2y ago
DARPA is basically a state-sponsored VC that optimizes for completely different things. Instead of looking for 100x financial returns, they want technical advantages for the United States. The "moat" is the hardness of developing and operationalizing those technologies first.
- woodruffw 2y ago
  DARPA's commercialization track record is decidedly mixed, so the VC comparison is unexpectedly apt :-) (But yes: DARPA's mandate is explicitly to discover and develop the next generation of emerging technologies for military use.)
  - pfdietz 2y ago
    Decades ago, as my father explained to me, ARPA (no "D" at that time) was happy if 1% of their projects went all the way through to successful deployment. If they had a higher success rate it would mean they weren't aiming high enough.
  - VikingCoder 2y ago
    > DARPA's commercialization track record is decidedly mixed... If you count my number of attempts, sure. If you count by impact, it's hard to come up with many things more impactful than the Internet...?
    - woodruffw 2y ago
      Yeah, I meant by number. But also: ARPA didn't commercialize the Internet! They explicitly refused to commercialize it; commercialization only happened after an Act of Congress induced interconnections between NSFNET and commercial networks.
- deleted 2y ago
  [deleted]
- mburns 2y ago
  To be pedantic, In-q-tel is the literal state-sponsored VC. DARPA is a step closer to traditional research labs but there is obviously some overlap. https://en.wikipedia.org/wiki/In-Q-Tel https://en.wikipedia.org/wiki/In-Q-Tel
  - throwup238 2y ago
    > DARPA is a step closer to traditional research labs but there is obviously some overlap. It's more like the NSF but focused on commercial grantees with project management thrown on top to orchestrate everything. The really unique part is how much independence each program manager has and the term limits that prevent empire building.
fsckboy 2y ago
in this case it seems to me the hard task that DARPA has chosen is to get me to forget how much they spent on pushing Ada.
- woodruffw 2y ago
  I can't find any clear references to DARPA (or ARPA) being involved in Ada's development. It was a DoD program but, well, the DoD is notoriously large and multi-headed. (But even if DARPA was involved in Ada: I think it's clear, at this point, that Ada has been a resounding success in a small number of domains without successfully breaking into general-purpose adoption. I don't have a particular value judgment associated with that, but from a strategic perspective it makes a lot of sense for DARPA to focus program analysis research on popular general-purpose languages -- there's just more labor and talent available.)
  - indolering 2y ago
    Too lazy to look it up, but I'm pretty sure DARPA was involved and certain that DoD contracta prioritized ADA for a long time.
    - rerdavies 2y ago
      Too bored to pass up a challenge to refute somebody who is too lazy to look it up. I looked it up. DARPA was not involved.
- reaperducer 2y ago
  in this case it seems to me the hard task that DARPA has chosen is to get me to forget how much they spent on pushing Ada. You hate jumbo jets, high-speed trains, air traffic control, and satellites?
  - 9659 2y ago
    Do you know what fear is? Getting in an airplane where the flight controls use NPM.

01HNNWZ0MV43FF 2y ago

Can't most c++ be machine-lowered to C?

pjmlp 2y ago
Yes, that is after all how C++ started. How good the resulting performance would be like, that is another matter.
woodruffw 2y ago
Lowering is typically easier than lifting (or brightening). When you lower, you can erase higher-level semantics that aren't relevant; when you lift, you generally want to compose lower-level program behaviors into their idiomatic (and typically safer) equivalent.

childintime 2y ago

Hard for humans. But it's DARPA, is it hard for AI? Image classification used to be hard also, today cars drive themselves. I'd say it's good timing.

childintime 2y ago
In my experience claude.ai has near perfect grasp of what a program (that fits its window) is written to do. It can already make a program in another language that can do the same. What this means is that the cost of a full rewrite is going to come down dramatically over the next few years. This is an excellent example of government action I like to see, as it isn't about favoritism or the swamp dynamics. Just provide a target, a bounty and no or low barriers to entry. This challenge does push Rust out in front of everybody. That's a mixed blessing. I hope this challenge gets modified to not specify the target language, but instead the requirement of memory and type safety. Rust is likely an intermediate stop on the way to something better, and it shouldn't matter if that language is called Rust 2.0 or something else.
mike_hearn 2y ago
Well, Claude 3.5 can do translation from one language to another in a fairly competent manner if the languages are close enough. I've used it for that task myself with success (Java -> JavaScript). But, this isn't just about rewriting code from one language to another. It's about reverse engineering complex information out of the code, which may not be immediately visible in it, and then finding a way to make it "safe" according to Rust's type system. Where's the training data for that? It'd be really hard even for skilled humans. Personally I think the most pragmatic way to make C/C++ memory safe quicker is one of two approaches: 1. Incrementally. Make std::vector[] properly bounds checked (still not done even in chrome!), convert allocations to allocations that know their own size and do bounds checking e.g. https://issues.chromium.org/issues/40285824 https://issues.chromium.org/issues/40285824 2. Or, go the whole hog and use runtime techniques like garbage collection and runtime bounds checks. A good example of approach (2) is Managed Sulong, which extends the JVM to execute LLVM bitcode directly whilst exposing to the C/C++/FORTRAN a virtualized Linux syscall interface. The whole piece of code can be sandboxed with permissions, and memory safety errors are caught at runtime. The compiler tries to optimize out as many bounds checks as possible. The interesting thing about this approach is it doesn't require big changes to the source code (as long as it's already been ported to Linux), which means the work of making something safe can be done by teams independent of the original authors. In practice "rewrite it in Rust" will usually mean a fork, which introduces lots of complicated technical, cultural and economic issues. Managed Sulong is also a research project and has a bunch of problems to solve, for instance it needs to lose the JITC dependency and go fully AOT compiled (doable, there's no theoretical issue with it and much of the needed infra already exists). And performance/memory usage can always be improved of course, it regresses vs the original C. But those are "just" systems engineering problems, not rewrite-the-world and solve-static-analysis problems. Disclosure: I do work part time at Oracle Labs which developed Managed Sulong, but I don't work on it.

sam0x17 2y ago

speaking of hard, the DOE actually funds a project that has been around for 20+ years now (ROSE) that involves (among other things) doing static analysis on and automatically translating between C/C++/Cuda and even high level languages like Python as well as HPC variants of C/C++. They have a combined AST that supports all of those languages with the same set of node types essentially. Quite cool. I got to work on it when I was an intern at Livermore, summer of 2014. and it's open source as well! http://rosecompiler.org/ROSE_HTML_Reference/index.html http://rosecompiler.org/ROSE_HTML_Reference/index.html

andrewflnr 2y ago
> a combined AST that supports all of those languages with the same set of node types essentially. I can't believe that works at all. I'll take a look for sure.
- sam0x17 2y ago
  Most of what they use it for is static analysis, but the funding comes from its ability to translate old simulation code to HPC-ready code. I think they even support fortran IIRC
seren 2y ago
I have already seen legacy projects that were designed using Rational Rose, but for some reason I thought it was only a commercial name, not an actual system. Thanks, I learned something today !
- andrewflnr 2y ago
  Your first instinct was more correct, that's definitely a different thing. :) https://en.wikipedia.org/wiki/IBM_Rational_Rose https://en.wikipedia.org/wiki/IBM_Rational_Rose

jandrese 2y ago

I have to think the approach will be something like "AI summarizes the features of the program into some kind of technical language, then the AI synthesizes Rust code that covers the same feature set". It would be most interesting if the approach was not to feed the program the original program but rather the manual for the program. That said it's rare that a manual captures all of the nuances of the program so a view into the source code is probably necessary, at least for getting the ground truth.

munificent 2y ago
More like: "AI more or less sort of summarizes the features of the program into some approximate kind of technical language, then the AI synthesizes something not too far from Rust code that hopefully covers aspirationally the same feature set".
- trealira 2y ago
  Ghidra, which is decompilation software, already manages to produce almost-valid C from assembly, and it does so without AI. I know nothing about how it works, but just from that, I'm guessing that producing almost-valid Rust from C code would be a simpler problem to solve.
ip26 2y ago
In theory, a codebase is a language precisely describing a program. The same program can be described in other languages. So that’s what you’re asking the LLM to do, in the same way you can describe a flower in either English or Spanish.

downrightmike 2y ago

If the IRS could have more timely funding, all their Cobol would be translated to Java by now

psunavy03 2y ago
COBOL migrations are tar pits of replicating 40+ years of undocumented niche business logic for a given field, edge cases included, that was "commonly understood" by people who are now retired or dead. Don't get your hopes up.
- pjmlp 2y ago
  MicroFocus has COBOL compilers for Java and .NET, as do other COBOL vendors still in business. Usually the biggest issue, is that most of the porting attempts don't start there, rather they go for the rewritte from scratch, and lets not pay the licenses for those cross-compilers.

the8472 2y ago

Write tests for your C code. Run c2rust (mechanical translation), including the tests. Let a LLM/MCTS/verifier loop go to town. Verifier here means it passes compiler checks, tests, santiziers and miri. Additional training data can be generated by running mrustc or by inlining unsafe code (from std/core/leaf crates) into safe code and running semantics-preserving mechanical refactorings on the code. This can be closer to AlphaProof than ChatGPT

astrange 2y ago
You could already use ASAN + UBSan, or Frama-C.
- the8472 2y ago
  I did mention using sanitizers in the verification step of the optimization loop. The optimization goal here would be reducing the lines of `unsafe` while preserving program semantics.
TestingWithEdd 2y ago
Essentially neural program synthesis

rectang 2y ago

I have to imagine that in the general case it will be a translation to unsafe Rust, with occasional isolated leaf nodes being translated to safe Rust. If you think it's hard wrestling with the borrow checker, just imagine how much harder it is to write automatic translation to borrow-checker-approved code that accounts for all the possible program space of C and all it's celebrated undefined behavior. A classic problem of writing compilers is that the space of valid programs is much larger than the space of programs which will compile. A quick web search reveals some other efforts, such as c2rust [1]. I wonder how TRACTOR differs. [1] https://github.com/immunant/c2rust https://github.com/immunant/c2rust

Someone 2y ago
> have to imagine that in the general case it will be a translation to unsafe Rust, with occasional isolated leaf nodes being translated to safe Rust. That’s not what they are aiming for. FTA: “The goal is to achieve the same quality and style that a skilled Rust developer would produce” > just imagine how much harder it is to write automatic translation to borrow-checker-approved code that accounts for all the possible program space of C and all it's celebrated undefined behavior Nitpick: undefined behavior gives the compiler leeway in deciding what a program does, so the more undefined behavior a C program invokes, the easier it is to translate its code to rust. (Doing that translation in such a way that the behavior remains what gcc, clang or “most C compilers” do may be harder, but I’m not sure of that)
- rectang 2y ago
  > undefined behavior gives the compiler leeway in deciding what a program does, so the more undefined behavior a C program invokes, the easier it is to translate its code to rust. That's the kind of language lawyer approach that caused a rebellion in the last decade amongst C programmers against irresponsible compiler optimizations. "Who cares if your program actually works as intended? My optimization is legal according to the standard, it's your program that's written to exploit loopholes". I don't see any evidence that that's the attitude being taken by TRACTOR — I sure hope it isn't. But hell, even if the result is unreliable in practice, I suppose that if somebody gets to claim "it works" then the incentives are aligned to produce garbage.

kragen 2y ago

presumably dan wouldn't have gotten darpa funding if it were obviously feasible, and success wouldn't give him anything publishable academically

dgacmu 2y ago
Just to be clear to others, Dan is the darpa PM on this - he convinced darpa internally it was worth funding other people to do the work, so he himself / his research group won't be doing this work. He's on leave from Rice for a few years to be a PM at DARPA's I2O. And while DARPA doesn't directly care about research publications as an outcome, there's certainly a publishable research component to this, as well as a lot of lower papers-per-$ engineering and validation work. A lot of the contracts they hand out end up going to some kind of contractor prime (BBN, Raytheon, that kind of company) with one or more academic subs. The academic subs publish.
- kragen 2y ago
  thank you for the correction; I didn't realize he was the darpa pm what you describe is exactly my experience as a darpa performer (on a program which dan is apparently now the pm for!)

elromulous 2y ago

> and most interesting code is written in C++ anyway. You're just asking for people to bring out their pitchforks :P

dlenski 2y ago

Man, I want to upvote this but… > most interesting code is written in C++ anyway. Really?! The Linux kernel is a _pretty enormous_ counterexample, as are many of the userland tools of most desktop Linux distros. I am also a key developer of an entirely-written-in-C tool which I'd venture that [a large fraction of desktop Linux users in corporate environments use on a regular basis](https://gitlab.com/openconnect/openconnect https://gitlab.com/openconnect/openconnect).

mike_hearn 2y ago
The refusal to use C++ in Linux isn't entirely rational. Nobody else makes that decision. Other kernels are a mix of C and C++ (macOS/iOS, Windows, even hobby operating systems like SerenityOS). Then you get into stuff that's not kernels and the user-spaces are again mostly all C++. The few exceptions that exist are coming out of the 90s UNIX culture, stuff like Apache or nginx. Beyond that it's all C++ or managed languages.
- dlenski 2y ago
  > The refusal to use C++ in Linux isn't entirely rational. Whether or not the decision not to use C++ is good or bad, rational or irrational, what is the relevance? The point is that the Linux kernel is technologically interesting and innovative, under very active development, and it's written in C. > The few exceptions that exist are coming out of the 90s UNIX culture, stuff like Apache or nginx. Beyond that it's all C++ or managed languages. I literally just told you about a software project to which I contribute, which thousands of people and organizations use, which is written in C. Also, it wasn't written in the ’90s.