4 ms·
Using communally audited abstractions over unsafe code means you’re using unsafe a lot. If there was some way to prove that the abstraction is safe, then that
by pizlonator 2y ago
Using communally audited abstractions over unsafe code means you’re using unsafe a lot.
If there was some way to prove that the abstraction is safe, then that would be fine. But the inadequacy of communal auditing is the reason why C has security issues.
- Philpax 2y agoThe area of Rust code that is unsafe is much, much smaller than the amount in equivalent C code, making it much more tractable to audit. I won't pretend that it's perfect, but it's not remotely comparable to C.
- pizlonator 2y agoThere’s no easy bound on the set of code you’d have to audit to confirm that even one use of unsafe is in fact safe.
- burjui 2y agoIt's literally THE unsafe part of the code. It's the only part of code that can invoke UB. fn do_something() { unsafe { ... } } // Somewhere in the program do_something(); Doesn't matter where "do_something" is used and how much. The only possibly problematic part of this code is the unsafe block. You only audit it.