4 ms·

https://4e6.github.io/firefox-lang-stats/ https://4e6.github.io/firefox-lang-stats/ Do you see those red and orange and green pie slices? 40% of the code. Th

https://4e6.github.io/firefox-lang-stats/ https://4e6.github.io/firefox-lang-stats/ Do you see those red and orange and green pie slices? 40% of the code. There, be memory errors. Approximately 70% of all errors in that code will be memory safety related and exploitable. Fixing it looks like developing Servo. Don't want to take my word for it? How about the US Department of Defense: https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI_SOFTWARE_MEMORY_SAFETY.PDF https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI...

dralley 2y ago
Mozilla continues to add new Rust to Firefox, despite discontinuing the Servo project. A big parallel rewrite is not the only possible approach to writing Rust. "Fixing it" does not have to look like Servo. In fact doing more incremental rewrites will improve the situation shown in that chart much faster than waiting 10 years for parity before doing the replacement. I'm not responding further until you actually read and understand what I'm saying instead of flailing at a strawman.
- timschmidt 2y ago
  > A big parallel rewrite is not the only possible approach to writing Rust. A rewrite is the only way to convert the codebase to Rust or any other memory safe language. Whether that happens in parallel, piecemeal, or both at the same time is down to how well you use a version control system and structure your code. As has already been shown by sharing Servo code with Firefox. A full rewrite is particularly useful with Rust, as the language wants you to structure your code differently than most C/C++ is structured. Doesn't make sense not to have one going if that's the plan. If you're going to rewrite the whole thing anyway, might as well do it in an idiomatic way.
  - bogeholm 2y ago
    > A full rewrite Things You Should Never Do, Part I [0] [0]: https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...
    - timschmidt 2y ago
      Things Mozilla have done a few times.[0] All with valid reason. 30 years without a rewrite is pretty rare for any piece of software. 0: https://en.wikipedia.org/wiki/Netscape_Navigator https://en.wikipedia.org/wiki/Netscape_Navigator
  - steveklabnik 2y ago
    Google has demonstrated that writing new code in a memory safe language still significantly improves the safety story of a codebase, even while keeping around the old code. Full scale rewrites are not the only option.
    - timschmidt 2y ago
      Yes, every line of C/C++ you can replace with a memory safe language in a critical codebase like a browser improves it's safety story. Which is exactly the reason replacing all of it is so attractive. But just to offer another point, I also still run into memory leaks and other performance issues in long-lived Firefox processes which, based on my experience with Rust, would be unlikely to be a problem in a functional Servo. It'd be nice to have a browser I don't have to occasionally kill and restart just to keep Youtube working.
      - cozzyd 2y ago
        You're seeing memory fragmentation which I would expect not to improve
        timschmidt 2y ago
        That's an interesting take about a language that puts variables on the stack by default. The less you put in the heap, the less fragmented it gets. Heap fragmentation also does not account for the ever growing memory footprint of a running instance.
        cozzyd 2y ago
        You're aware that C++ and C are also stack allocating by default? Unless you mean something different than what I understand.
        timschmidt 2y ago
        C requires malloc (and the heap) for anything that lives beyond the scope of the function lifetime. C++ adds smart pointers and copy/move semantics, but default behavior is still like C, and defaults matter.

dralley 2y ago

Mozilla continues to add new Rust to Firefox, despite discontinuing the Servo project. A big parallel rewrite is not the only possible approach to writing Rust. "Fixing it" does not have to look like Servo. In fact doing more incremental rewrites will improve the situation shown in that chart much faster than waiting 10 years for parity before doing the replacement. I'm not responding further until you actually read and understand what I'm saying instead of flailing at a strawman.

timschmidt 2y ago
> A big parallel rewrite is not the only possible approach to writing Rust. A rewrite is the only way to convert the codebase to Rust or any other memory safe language. Whether that happens in parallel, piecemeal, or both at the same time is down to how well you use a version control system and structure your code. As has already been shown by sharing Servo code with Firefox. A full rewrite is particularly useful with Rust, as the language wants you to structure your code differently than most C/C++ is structured. Doesn't make sense not to have one going if that's the plan. If you're going to rewrite the whole thing anyway, might as well do it in an idiomatic way.
- bogeholm 2y ago
  > A full rewrite Things You Should Never Do, Part I [0] [0]: https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...
  - timschmidt 2y ago
    Things Mozilla have done a few times.[0] All with valid reason. 30 years without a rewrite is pretty rare for any piece of software. 0: https://en.wikipedia.org/wiki/Netscape_Navigator https://en.wikipedia.org/wiki/Netscape_Navigator
- steveklabnik 2y ago
  Google has demonstrated that writing new code in a memory safe language still significantly improves the safety story of a codebase, even while keeping around the old code. Full scale rewrites are not the only option.
  - timschmidt 2y ago
    Yes, every line of C/C++ you can replace with a memory safe language in a critical codebase like a browser improves it's safety story. Which is exactly the reason replacing all of it is so attractive. But just to offer another point, I also still run into memory leaks and other performance issues in long-lived Firefox processes which, based on my experience with Rust, would be unlikely to be a problem in a functional Servo. It'd be nice to have a browser I don't have to occasionally kill and restart just to keep Youtube working.
    - cozzyd 2y ago
      You're seeing memory fragmentation which I would expect not to improve
      - timschmidt 2y ago
        That's an interesting take about a language that puts variables on the stack by default. The less you put in the heap, the less fragmented it gets. Heap fragmentation also does not account for the ever growing memory footprint of a running instance.
        cozzyd 2y ago
        You're aware that C++ and C are also stack allocating by default? Unless you mean something different than what I understand.
        timschmidt 2y ago
        C requires malloc (and the heap) for anything that lives beyond the scope of the function lifetime. C++ adds smart pointers and copy/move semantics, but default behavior is still like C, and defaults matter.