4 ms·

Apple handled this problem by adding memory safety to C (Firebloom). It seems unlikely they would throw away that investment and move to Rust. I’m sure lots of

by QuiEgo 10mo ago

Apple handled this problem by adding memory safety to C (Firebloom). It seems unlikely they would throw away that investment and move to Rust. I’m sure lots of other companies don’t want to throw away their existing code, and when they write new code there will always be a desire to draw on prior art.

goku12 10mo ago
That's a rather pessimistic take compared to what's actually happening. What you say should apply to the big players like Amazon, Google, Microsoft, etc the most, because they arguably have massive C codebases. Yet, they're also some of the most enthusiastic adopters and promoters of Rust. A lot of other adopters also have legacy C codebases. I'm not trying to hype up Rust or disparage C. I learned C first and then Rust, even before Rust 1.0 was released. And I have an idea why Rust finds acceptance, which is also what some of these companies have officially mentioned. C is a nice little language that's easy to learn and understand. But the price you pay for it is in large applications where you have to handle resources like heap allocations. C doesn't offer any help there when you make such mistakes, though some linters might catch them. The reason for this, I think, is that C was developed in an era when they didn't have so much computing power to do such complicated analysis in the compiler. People have been writing C for ages, but let me tell you - writing correct C is a whole different skill that's hard and takes ages to learn. If you think I'm saying this because I'm a bad programmer, then you would be wrong. I'm not a programmer at all (by qualification), but rather a hardware engineer who is more comfortable with assembly, registers, Bus, DRAM, DMA, etc. I still used to get widespread memory errors, because all it takes is a lapse in attention while coding. That strain is what Rust alleviates.
- Surac 10mo ago
  So you try to say c is for good programmers only and rust let also the idiots Programm? I think that’s the wrong way to argue for rust. Rust catches one kind of common problem but but does not magically make logic errors away.
  - ykonstant 10mo ago
    No, they are not saying that at all??
  - goku12 10mo ago
    No
- torginus 10mo ago
  I'm curious why your perspective on Rust as a HW engineer. Hardware does a ton of things - DMA, interrupts, etc. that are not really compatible with Rust's memory model - after all Rust's immutable borrows should guarantee the values you are reading are not aliased by writers and should be staying constant as long as the borrow exists. This is obviously not true when the CPU can either yank away the execution to a different part of the program, or some foreign entity can overwrite your memory. Additionally, in low-level embedded systems, the existence of malloc is not a given, yet Rust seems to assume you can dynamically allocate memory with a stateless allocator.
  - QuiEgo 10mo ago
    I’d like to take a swipe at this Rust has no_std to handle not having an allocator. Tons of things end up being marked “unsafe” in systems/embedded Rust. The idea is you sandbox the unsafeness. Libraries like zero copy are a good example of “containing” unsafe memory accesses in a way that still gets you as much memory safety as possible given the realities of embedded. Tl;dr you don’t get as much safety as higher level code but you still get more than C. Or maybe put a different way you are forced to think about the points that are inherently unsafe and call them out explicitly (which is great when you think about how to test the thing)
    - torginus 10mo ago
      Dunno. I used to do embedded. A ton of (highly capable) systems have tiny amounts of RAM (like 32kb-128kb). Usually these controllers run a program in an infinite event loop (with perhaps a sleep in the end of the iteration), communication with peripherals is triggered via interrupts. There's no malloc, memory is pre-mapped. This means: - All lifetimes are either 'stack' or 'forever' - Thread safety in the main loop is ensured by disabling interrupts in the critical section - Rust doesn't understand this paradigm (it can be taught to, I'm sure) - Thread safety in ISRs should also be taught to Rust - Peripherals read and write to memory via DMA, unbekownst to the CPU etc. So all in all, I don't see Rust being that much more beneficial (except for stuff like array bounds checking). I'm sure you can describe all these behaviors to Rust so that it can check your program, but threading issues are limited, and there's no allocation, and no standard lib (or much else from cargo). Rust may be a marginally better language than C due to some convenience features, but I feel like there's too much extra work very little benefit.
- QuiEgo 10mo ago
  Not trying to make a value judgement on Rust either, just brainstorming why Rust changeover might go slow per the question. FWIW I work in firmware with the heap turned off. I’ve worked on projects in both C and Rust, and agree Rust still adds useful checks (at the cost of compile times and binary sizes). It seems worth the trade off for most projects.
  - goku12 10mo ago
    Okay. That sounds like a reasonable explanation. Thanks!
AceJohnny2 10mo ago
> It seems unlikely [Apple] would throw away that investment and move to Rust. Apple has invested in Swift, another high level language with safety guarantees, which happens to have been created under Chris Lattner, otherwise known for creating LLVM. Swift's huge advantage over Rust, for application and system programming is that it supports an ABI [1] which Rust, famously, does not (other than falling back to a C ABI, which degrades its promises). [1] for more on that topic, I recommend this excellent article: https://faultlore.com/blah/swift-abi/ https://faultlore.com/blah/swift-abi/ Side note, the author of that article wrote Rust's std::collections API.
- gjajric 10mo ago
  Swift does not seem suitable for OS development, at least not as much as C or C++.[0] Swift handles by default a lot of memory by using reference counting, as I understand it, which is not always suitable for OS development. [0]: Rust, while no longer officially experimental in the Linux kernel, does not yet have major OSs written purely in it.
  - pjmlp 10mo ago
    What matters is what Apple thinks, and officially it is, to the point it is explicitly written on the documentation.
    - gjajric2 10mo ago
      The practical reality is arguably more important than beliefs. Apple has, as it turns out, invested in trying to make Swift more suitable for kernel and similar development, like trying to automate away reference counting when possible, and also offering Embedded Swift[0], an experimental subset of Swift with significant restrictions on what is allowed in the language. Maybe Embedded Swift will be great in the future, and it is true that Apple investing into that is significant, but it doesn't seem like it's there. > Embedded Swift support is available in the Swift development snapshots. And considering Apple made Embedded Swift, even Apple does not believe that regular Swift is suitable. Meaning that you're undeniably completely wrong. [0]: https://github.com/swiftlang/swift-evolution/blob/main/visions/embedded-swift.md https://github.com/swiftlang/swift-evolution/blob/main/visio...
pjmlp 10mo ago
Also, Swift Embedded came out of the effort to eventually use Swift instead for such use cases at Apple.

by QuiEgo 10mo ago

goku12 10mo ago

That's a rather pessimistic take compared to what's actually happening. What you say should apply to the big players like Amazon, Google, Microsoft, etc the most, because they arguably have massive C codebases. Yet, they're also some of the most enthusiastic adopters and promoters of Rust. A lot of other adopters also have legacy C codebases. I'm not trying to hype up Rust or disparage C. I learned C first and then Rust, even before Rust 1.0 was released. And I have an idea why Rust finds acceptance, which is also what some of these companies have officially mentioned. C is a nice little language that's easy to learn and understand. But the price you pay for it is in large applications where you have to handle resources like heap allocations. C doesn't offer any help there when you make such mistakes, though some linters might catch them. The reason for this, I think, is that C was developed in an era when they didn't have so much computing power to do such complicated analysis in the compiler. People have been writing C for ages, but let me tell you - writing correct C is a whole different skill that's hard and takes ages to learn. If you think I'm saying this because I'm a bad programmer, then you would be wrong. I'm not a programmer at all (by qualification), but rather a hardware engineer who is more comfortable with assembly, registers, Bus, DRAM, DMA, etc. I still used to get widespread memory errors, because all it takes is a lapse in attention while coding. That strain is what Rust alleviates.

Surac 10mo ago
So you try to say c is for good programmers only and rust let also the idiots Programm? I think that’s the wrong way to argue for rust. Rust catches one kind of common problem but but does not magically make logic errors away.
- ykonstant 10mo ago
  No, they are not saying that at all??
- goku12 10mo ago
  No
torginus 10mo ago
I'm curious why your perspective on Rust as a HW engineer. Hardware does a ton of things - DMA, interrupts, etc. that are not really compatible with Rust's memory model - after all Rust's immutable borrows should guarantee the values you are reading are not aliased by writers and should be staying constant as long as the borrow exists. This is obviously not true when the CPU can either yank away the execution to a different part of the program, or some foreign entity can overwrite your memory. Additionally, in low-level embedded systems, the existence of malloc is not a given, yet Rust seems to assume you can dynamically allocate memory with a stateless allocator.
- QuiEgo 10mo ago
  I’d like to take a swipe at this Rust has no_std to handle not having an allocator. Tons of things end up being marked “unsafe” in systems/embedded Rust. The idea is you sandbox the unsafeness. Libraries like zero copy are a good example of “containing” unsafe memory accesses in a way that still gets you as much memory safety as possible given the realities of embedded. Tl;dr you don’t get as much safety as higher level code but you still get more than C. Or maybe put a different way you are forced to think about the points that are inherently unsafe and call them out explicitly (which is great when you think about how to test the thing)
  - torginus 10mo ago
    Dunno. I used to do embedded. A ton of (highly capable) systems have tiny amounts of RAM (like 32kb-128kb). Usually these controllers run a program in an infinite event loop (with perhaps a sleep in the end of the iteration), communication with peripherals is triggered via interrupts. There's no malloc, memory is pre-mapped. This means: - All lifetimes are either 'stack' or 'forever' - Thread safety in the main loop is ensured by disabling interrupts in the critical section - Rust doesn't understand this paradigm (it can be taught to, I'm sure) - Thread safety in ISRs should also be taught to Rust - Peripherals read and write to memory via DMA, unbekownst to the CPU etc. So all in all, I don't see Rust being that much more beneficial (except for stuff like array bounds checking). I'm sure you can describe all these behaviors to Rust so that it can check your program, but threading issues are limited, and there's no allocation, and no standard lib (or much else from cargo). Rust may be a marginally better language than C due to some convenience features, but I feel like there's too much extra work very little benefit.
QuiEgo 10mo ago
Not trying to make a value judgement on Rust either, just brainstorming why Rust changeover might go slow per the question. FWIW I work in firmware with the heap turned off. I’ve worked on projects in both C and Rust, and agree Rust still adds useful checks (at the cost of compile times and binary sizes). It seems worth the trade off for most projects.
- goku12 10mo ago
  Okay. That sounds like a reasonable explanation. Thanks!

AceJohnny2 10mo ago

> It seems unlikely [Apple] would throw away that investment and move to Rust. Apple has invested in Swift, another high level language with safety guarantees, which happens to have been created under Chris Lattner, otherwise known for creating LLVM. Swift's huge advantage over Rust, for application and system programming is that it supports an ABI [1] which Rust, famously, does not (other than falling back to a C ABI, which degrades its promises). [1] for more on that topic, I recommend this excellent article: https://faultlore.com/blah/swift-abi/ https://faultlore.com/blah/swift-abi/ Side note, the author of that article wrote Rust's std::collections API.

gjajric 10mo ago
Swift does not seem suitable for OS development, at least not as much as C or C++.[0] Swift handles by default a lot of memory by using reference counting, as I understand it, which is not always suitable for OS development. [0]: Rust, while no longer officially experimental in the Linux kernel, does not yet have major OSs written purely in it.
- pjmlp 10mo ago
  What matters is what Apple thinks, and officially it is, to the point it is explicitly written on the documentation.
  - gjajric2 10mo ago
    The practical reality is arguably more important than beliefs. Apple has, as it turns out, invested in trying to make Swift more suitable for kernel and similar development, like trying to automate away reference counting when possible, and also offering Embedded Swift[0], an experimental subset of Swift with significant restrictions on what is allowed in the language. Maybe Embedded Swift will be great in the future, and it is true that Apple investing into that is significant, but it doesn't seem like it's there. > Embedded Swift support is available in the Swift development snapshots. And considering Apple made Embedded Swift, even Apple does not believe that regular Swift is suitable. Meaning that you're undeniably completely wrong. [0]: https://github.com/swiftlang/swift-evolution/blob/main/visions/embedded-swift.md https://github.com/swiftlang/swift-evolution/blob/main/visio...

pjmlp 10mo ago

Also, Swift Embedded came out of the effort to eventually use Swift instead for such use cases at Apple.