5 ms·

Almost all uses of unsafe in Rust are either for FFI, or to avoid the overhead of things like ref-counting. If you use, eg, Rc RefCell everywhere you will achie

Almost all uses of unsafe in Rust are either for FFI, or to avoid the overhead of things like ref-counting. If you use, eg, Rc RefCell everywhere you will achieve safety without issue.

pizlonator 11mo ago
> Almost all uses of unsafe in Rust are either for FFI Which makes Rust less safe than Fil-C. Consider that you have a dependency like libc, PAM, openssl, or the like. In Rust: you will `unsafe` call into the unsafe versions of those libraries. Hence, even if your Rust code is safe in isolation, your program is not safe overall because you're pulling in unsafe code. In Fil-C: compile those dependencies with Fil-C, and then the whole process is safe.
- josephg 11mo ago
  > In Fil-C: compile those dependencies with Fil-C, and then the whole process is safe. Great work on Fil-C by the way. Very technically impressive stuff! It seems like the competition for Fil-C is other garbage collected languages. Rust will always outperform Fil-C, with the caveat that rust allows unsafe blocks, raw pointers and raw C FFI. But if you’re happy to ditch performance and the ability to do bare metal systems level programming, why Fil-C over Go or C#? If you want a safer, less convenient dialect of rust, that also exists. Just don’t use or depend on any unsafe code in your program. (There are 3rd party tools to check this). More and more C libraries are getting pure rust ports these days. It’s increasingly rare to actually need to pull in C libraries at all. Sticking to safe rust is a bit inconvenient - but I suspect so is using fil-c. I suppose with fil-C you can use any libraries you want, you’ve just gotta recompile them. That’s cool! Rust has a bunch of unsafe code in std, so you’re still at risk of a bug there causing safety problems. But the same is true of Fil-C. I could definitely see myself reaching for Fil-C when running legacy code. It’d be nice if there was a way to use fil-C to protect my rust program from memory bugs in C dependencies. But I can think of dozens of ways why that would be tricky to pull off. Also I’m curious - can Fil-C protect against threading bugs like rust can? Rust has Send & Sync traits to mark which objects can be safely shared between threads. I can’t think of a way to do that in an automated way without help from the programmer.
  - drnick1 11mo ago
    > More and more C libraries are getting pure rust ports these days. I don't think these rewrites will ever be mainstream. There is so much C out there, and typically ports focus on the 90% that is easy to write and neglect the remaining 10%.
    - josephg 11mo ago
      > I don't think these rewrites will ever be mainstream. Forever is a long time. And there's always a huge appetite amongst smart young developers to create their own ecosystem. After all, you don't become Linus Torvalds by contributing to linux. You become linus torvalds by creating your own operating system from scratch. Whether or not new implementations become valuable and get maintained over time is an open question. But the energy is definitely there. (Even though its not necessarily pointed in the direction of economically useful, long lived software.) > typically ports focus on the 90% that is easy to write and neglect the remaining 10%. I hear a claim like: "The current C version of most tools is the only place, and only project which will ever bother solving its chosen problem properly." I'm not sure if tahts quite what you mean, but its a wildly bold claim. Even in C and C++, this seems already false. There's several good, solid, standards compliant SQL databases. And OS kernels. And compilers. And web browsers. If there's room for several C based OS kernels, do you really think there'll never be a viable OS kernel in rust, Zig or Odin? Or a web browser or compiler?
      - drnick1 11mo ago
        > And there's always a huge appetite amongst smart young developers to create their own ecosystem. After all, you don't become Linus Torvalds by contributing to linux. You become linus torvalds by creating your own operating system from scratch. The tech landscape was completely different back then. Linus himself stated that had BSD been free at the time, he wouldn't have started working on a free MINIX clone. He worked to solve a concrete problem (the lack of a free UNIX-like kernel), he didn't partially rewrite something that exists and works well just to "create his own ecosystem."
- viraptor 11mo ago
  > you will `unsafe` call into the unsafe versions of those libraries Maybe. There's rust version of libc and SSL already. On the other hand fil-c won't help with dependencies written in C++, Fortran, and lots of others. The "less safe" gets very context dependent.
  - aw1621107 11mo ago
    > On the other hand fil-c won't help with dependencies written in C++, Fortran, and lots of others. IIRC Fil-C is already documented to work with C++. It's not immediately obvious to me that there are any fundamental reasons Fil-C wouldn't work for Fortran and "lots of others" as well; a fairly large chunk of its work is done via a pass on LLVM IR [0] so anything that compiles to LLVM could reap Fil-C's benefits with (probably?) relatively minor alterations to frontends. [0]: https://fil-c.org/compiler https://fil-c.org/compiler
    - pizlonator 11mo ago
      Yeah, putting Fortran through the Fil-C pipeline is just a matter of a handful of hacks in flang.

Almost all uses of unsafe in Rust are either for FFI, or to avoid the overhead of things like ref-counting. If you use, eg, Rc RefCell everywhere you will achieve safety without issue.

pizlonator 11mo ago

> Almost all uses of unsafe in Rust are either for FFI Which makes Rust less safe than Fil-C. Consider that you have a dependency like libc, PAM, openssl, or the like. In Rust: you will `unsafe` call into the unsafe versions of those libraries. Hence, even if your Rust code is safe in isolation, your program is not safe overall because you're pulling in unsafe code. In Fil-C: compile those dependencies with Fil-C, and then the whole process is safe.

josephg 11mo ago
> In Fil-C: compile those dependencies with Fil-C, and then the whole process is safe. Great work on Fil-C by the way. Very technically impressive stuff! It seems like the competition for Fil-C is other garbage collected languages. Rust will always outperform Fil-C, with the caveat that rust allows unsafe blocks, raw pointers and raw C FFI. But if you’re happy to ditch performance and the ability to do bare metal systems level programming, why Fil-C over Go or C#? If you want a safer, less convenient dialect of rust, that also exists. Just don’t use or depend on any unsafe code in your program. (There are 3rd party tools to check this). More and more C libraries are getting pure rust ports these days. It’s increasingly rare to actually need to pull in C libraries at all. Sticking to safe rust is a bit inconvenient - but I suspect so is using fil-c. I suppose with fil-C you can use any libraries you want, you’ve just gotta recompile them. That’s cool! Rust has a bunch of unsafe code in std, so you’re still at risk of a bug there causing safety problems. But the same is true of Fil-C. I could definitely see myself reaching for Fil-C when running legacy code. It’d be nice if there was a way to use fil-C to protect my rust program from memory bugs in C dependencies. But I can think of dozens of ways why that would be tricky to pull off. Also I’m curious - can Fil-C protect against threading bugs like rust can? Rust has Send & Sync traits to mark which objects can be safely shared between threads. I can’t think of a way to do that in an automated way without help from the programmer.
- drnick1 11mo ago
  > More and more C libraries are getting pure rust ports these days. I don't think these rewrites will ever be mainstream. There is so much C out there, and typically ports focus on the 90% that is easy to write and neglect the remaining 10%.
  - josephg 11mo ago
    > I don't think these rewrites will ever be mainstream. Forever is a long time. And there's always a huge appetite amongst smart young developers to create their own ecosystem. After all, you don't become Linus Torvalds by contributing to linux. You become linus torvalds by creating your own operating system from scratch. Whether or not new implementations become valuable and get maintained over time is an open question. But the energy is definitely there. (Even though its not necessarily pointed in the direction of economically useful, long lived software.) > typically ports focus on the 90% that is easy to write and neglect the remaining 10%. I hear a claim like: "The current C version of most tools is the only place, and only project which will ever bother solving its chosen problem properly." I'm not sure if tahts quite what you mean, but its a wildly bold claim. Even in C and C++, this seems already false. There's several good, solid, standards compliant SQL databases. And OS kernels. And compilers. And web browsers. If there's room for several C based OS kernels, do you really think there'll never be a viable OS kernel in rust, Zig or Odin? Or a web browser or compiler?
    - drnick1 11mo ago
      > And there's always a huge appetite amongst smart young developers to create their own ecosystem. After all, you don't become Linus Torvalds by contributing to linux. You become linus torvalds by creating your own operating system from scratch. The tech landscape was completely different back then. Linus himself stated that had BSD been free at the time, he wouldn't have started working on a free MINIX clone. He worked to solve a concrete problem (the lack of a free UNIX-like kernel), he didn't partially rewrite something that exists and works well just to "create his own ecosystem."
viraptor 11mo ago
> you will `unsafe` call into the unsafe versions of those libraries Maybe. There's rust version of libc and SSL already. On the other hand fil-c won't help with dependencies written in C++, Fortran, and lots of others. The "less safe" gets very context dependent.
- aw1621107 11mo ago
  > On the other hand fil-c won't help with dependencies written in C++, Fortran, and lots of others. IIRC Fil-C is already documented to work with C++. It's not immediately obvious to me that there are any fundamental reasons Fil-C wouldn't work for Fortran and "lots of others" as well; a fairly large chunk of its work is done via a pass on LLVM IR [0] so anything that compiles to LLVM could reap Fil-C's benefits with (probably?) relatively minor alterations to frontends. [0]: https://fil-c.org/compiler https://fil-c.org/compiler
  - pizlonator 11mo ago
    Yeah, putting Fortran through the Fil-C pipeline is just a matter of a handful of hacks in flang.