6 ms·
That was my take when LibSQL was announced. And it still is and would be my take if LibSQL remains C-coded. But a Rust-coded rewrite of SQLite3 or LibSQL is a
by cryptonector 2y ago
That was my take when LibSQL was announced. And it still is and would be my take if LibSQL remains C-coded. But a Rust-coded rewrite of SQLite3 or LibSQL is a different story.
The SQLite3 business model is that SQLite3 is open source but the best test suite for it is proprietary, and they don't accept contributions to any of either. This incentivizes anyone who needs support and/or new features in SQLite3 to join the SQLite Consortium. It's a great business model -- I love it. But there are many users who want more of a say than even being a consortium member would grant them, and they want to contribute. For those users only a fork would make sense. But a fork would never gain much traction given that test suite being proprietary, and the SQLite3 team being so awesome.
However, a memory-safe language re-implementation of SQLite3 is a very different story. The U.S. government wants everyone to abandon C/C++ -- how will they do this if they depend on SQLite3? Apart from that there's also just a general interest and need to use memory-safe languages.
That said, you're right that there are many other projects that call for a rewrite in Rust way before SQLite3. The thing is: if you have the need and the funding, why wouldn't you rewrite the things you need first? And if SQLite3 is the first thing you need rewritten, why not?
- galangalalgol 2y agoAlso the very rigid testing makes the rewrite a lot easier to validate.
- nine_k 2y ago...as long as you can persuade the keepers of the proprietary test suite to agree to run it against your code.
- encoderer 2y agoEven without that, it’s helpful. It means there is less (no?) undefined behavior that you will need to emulate to maintain compatibility. You can just follow the spec.
- dotancohen 2y agoIf you can not run the test suite, then how do you know that you properly followed the spec? And did so securely? And in a performant manner? Even for edge cases? On obscure hardware, filesystems, and OSes? Even if the power cuts out? Or the cable to the hard drive (transactions)? Even if a stray cosmic ray flips a bit? By the way, SQLite itself does not meet one of these criteria. Know which one? ))
- encoderer 2y agoI’m not sure what your point is? Yes, it would be better if they would run their tests against your fork. But they won’t. Still, it’s better for the fork writer that they exist.
- bruce511 2y ago>> The SQLite3 business model is that SQLite3 is open source This is going to sound pedantic, but SQLite is not Open Source. It's Public Domain. The distinction is subtle, but it is important.
- wmf 2y agoPublic domain is a form of open source.
- thih9 2y agoNo. At least according to the Open Source Initiative, public domain is not open source: https://opensource.org/blog/public-domain-is-not-open-source https://opensource.org/blog/public-domain-is-not-open-source
- quotemstr 2y agoAny definition of open source that doesn't include the public domain is out of touch with how real people use the words "open source" and is therefore useless. You can make up any definition you want, but if you insist on calling elephants "bananas", I'm not going to take you seriously
- CorrectHorseBat 2y agoYou should read the text, it's not about calling elephants bananas but real issues with software in the public domain
- quotemstr 2y agoI read the text: it's license hermenuetics at best and FUD at worst. Has there been a single instance in recorded history of the author of a public domain work trying to enforce usage, modification, or distribution permissions. Sure, you can point to theoretical variation in the precise semantics of the public domain in various jurisdictions, but it feels like a bar exam puzzle, not a real world practical concern. In the real world, you can safely do whatever you want with public domain software. It counts as free software. That half the planet nowadays uses SQLite and treats it as free software is testament to this reality. Obscure license pedanticism just doesn't inform the choices of anyone actually building.
- somat 2y agoWhy does the fork have to gain traction? You keep and maintain your local fork that does what you need it to do. perhaps if you are charitable you share it with others. but you don't need to do this. and it just adds support burden.
- cryptonector 2y agoIf you don't care about traction then you wouldn't seek press for your fork to begin with. TFA is clearly seeking traction.
- fweimer 2y agoBugs are fixed along with regression tests. Here's a recent example: https://www.sqlite.org/src/info/289daf6cee39625e https://www.sqlite.org/src/info/289daf6cee39625e As far as I can see, these tests come with the same public domain dedication as the rest of the code. You may be referring to the TH3 tests (https://sqlite.org/th3.html https://sqlite.org/th3.html). The main goal (100% branch coverage, 100% MC/DC) would not be achievable for a Rust implementation (or at least an idiomatic Rust implementation …) because of the remaining dynamic run-time checks Rust requires for safety.
- pornel 2y agosqlite also has some runtime checks that are expected to be always true or always false, and solves that by using a custom macro that removes these branches during branch coverage test. The same would be possible in Rust. Everything that could panic has a non-panicking alternative, and you could conditionally insert `unreachable_unchecked()` to error handling branches to remove them. That wouldn't be most idiomatic, but SQLite's solution is also a custom one.
- zsims 2y ago> The U.S. government wants everyone to abandon C/C++ -- how will they do this if they depend on SQLite3? ABI, the same way you don't need the Linux kernel to be rewritten to remove your app dependency on C/C++
- akira2501 2y ago> The U.S. government wants everyone to abandon C/C++ That's the position of two federal agencies, namely, FBI and CISA. They don't describe how this change will reduce CVEs or why the languages they prefer still produce projects with CVEs. I don't particularly hold the technical or social acumen of FBI or CISA in particularly high regard and I'm not sure why anyone would by default either. Mostly because they say things like "switch to python!" without once accounting for the fact that python is written in C. It's an absurd point to invoke as a defense of this idea.
- rnmkr 2y agoWell Google's Rust report is already out with great results.. so..
- froh 2y ago> The SQLite3 business model is that SQLite3 is open source but the best test suite for it is proprietary no. the business model is services, and a red phone to companies who use sqlite in production. like nokia back in the days when we had these little flip phones, or desk phones had a "rolodesk" built in, or many other embedded uses of a little lovely dependable data store. the services include porting to and "certification" on specifically requested hardware and OS combinations, with indeed proprietary test suites. now these are not owned by sqlite, but by third parties. which license them to sqlite (the company). and it started with being paid by the likes of nokia or IBM to make sqlite production ready, add mc/dc coverage, implement fuzzing, etc etc etc., their license asks you to do good not evil. and they take that serious and try their best to do the same. their own stuff is to an extreme extend in the public domain.
- ale42 2y ago> companies who use sqlite in production It's not just old Nokias or desktop phones, nor just embedded sytsems. sqlite is almost everywhere. Adobe, Apple, Microsoft, Google, Mozilla and many other companies use it in very widely deployed software.
- cryptonector 2y ago> > The SQLite3 business model is that SQLite3 is open source but the best test suite for it is proprietary > no. > the business model is services, and a red phone to companies who use sqlite in production. like nokia back in the days when we had these little flip phones, or desk phones had a "rolodesk" built in, or many other embedded uses of a little lovely dependable data store. Members of the SQLite Consortium surely have this "red phone" you speak of. So in what way was my characterization of their business model wrong?
- orthelt 2y agoJust stumbled onto this forum. Really, appreciated such a thoughtful and insightful comment. Nice corner of the internet you have here.
- dang 2y agoWelcome to HN! (I'm a mod here.) I'm curious—how did you find us?