4 ms·

> The US government recently called on everyone to stop using them and move to memory-safe languages. The US government also _really_ (no sarcasm) cares about

> The US government recently called on everyone to stop using them and move to memory-safe languages. The US government also _really_ (no sarcasm) cares about safety-critical code that can be formally verified, depending on program requirements. DO-178, LOR1, el. al. Developing those toolchains costs tens of millions, getting them certified costs tens of millions, and then buying those products to use costs 500k-1.5m a pop. Those toolchains do not exist for rust. I am only aware of these toolchains existing for C, and old C at that. Hell, rust doesn't even have a formal spec, which is a bit of a roadblock.

monocasa 10mo ago
https://blog.pictor.us/rust-is-do-178-certifiable/ https://blog.pictor.us/rust-is-do-178-certifiable/
- irishcoffee 10mo ago
  > While Rust isn’t “certified” out of the box, it provides attributes that facilitate certification. By design, Rust restricts certain low-level operations and enforces strict memory safety rules, effectively shifting much of the error-checking and verification into compile-time. This means that issues that might otherwise be found by multiple external tools in C/C++ are caught early during the Rust build process. I think your link agrees with me, actually.
  - steveklabnik 10mo ago
    https://ferrocene.dev/ https://ferrocene.dev/ DO-178C isn’t there yet, but I believe I heard that it’s coming. In general, Ferrous Systems works with customer demand, which has been more automotive to start.
    - irishcoffee 10mo ago
      I believe is may come, that would be really neat. Actually having it happen, someone is going to be out 10-30 million bucks. And again for each new compiler version.
      - steveklabnik 10mo ago
        Qualifying Ferrocene was way, way, way less expensive than that, and they've already had multiple versions of Rust qualified. The incremental qualifications are even easier and cheaper than the initial one is.
        irishcoffee 10mo ago
        26262 is a lot less expensive than DO-178.
        steveklabnik 10mo ago
        I'd believe it, but from talking about this with the Ferrocene folks, there's just structural issues why it was much easier to qualify rustc than it has been to qualify C compilers. This is how they're able to offer the product at a significantly lower price point, and how they've been able to fairly regularly re-qualify new versions quickly. It is certainly non-trivial.
  - monocasa 10mo ago
    > With developments such as the Ferrocene-qualified compiler, Rust can now meet all the analysis requirements under DO-178C, one of the most stringent safety-critical standards worldwide.
    - irishcoffee 10mo ago
      “Can meet” vs “has met” is the entire difference. Clearly C “can meet” and “has met” DO-178. So, I posit that more languages than C “can meet” this standard. Proving it is the very hard, very expensive part. Oh, and whatever version of the rust compiler that gets certified will be locked down as the only certified toolchain. No more compiler updates every 6 weeks. Unless you go though the whole process again.
      - steveklabnik 10mo ago
        Ferrocene has qualified Rust 1.68.2, 1.76.0, 1.79.0, 1.81.0, 1.83.0, 1.86.0, 1.87.0, 1.89.0, with 1.91.0 in the upcoming release. It's not every six weeks, but it's far faster than once every three years.
ok123456 10mo ago
The DOD also made the Waterfall method THE standard software development process.
- lelanthran 10mo ago
  > The DOD also made the Waterfall method THE standard software development process. I'm sure they also made a few bad decisions too :-P
- Koshkin 10mo ago
  You mean, "DOW"
  - layer8 10mo ago
    Department of Waterfall?
    - zabzonk 10mo ago
      Department of War.
      - quesera 10mo ago
        That is not the official name, and it is highly unlikely that it ever will be in the future.
        runjake 10mo ago
        It's worth pointing out the Department of Defense was named the Department of War for over 150 years, up until 1947. https://en.wikipedia.org/wiki/United_States_Department_of_War https://en.wikipedia.org/wiki/United_States_Department_of_Wa...
        quesera 10mo ago
        True, but it required congressional approval to change the name then, and it would now as well. This congress is not likely to approve it. And the next congress, even less so. That said, "ever" is probably too strong. There's a window wherein the chaos which is currently being actively created by the US will develop to an extent that compels the US (or is sold to US voters as a necessary step) to adopt a foreign policy where it would be the more appropriate title. And if the adults can't manage that with charismatic leadership in the next election cycle or two, we could be right back here again, with quasi-legitimate geopolitical justification for the sort of big-stick wagging we see today. I honestly think this is the goal, and I'm not sure the American people are up to the challenge of preventing it.

monocasa 10mo ago

https://blog.pictor.us/rust-is-do-178-certifiable/ https://blog.pictor.us/rust-is-do-178-certifiable/

irishcoffee 10mo ago
> While Rust isn’t “certified” out of the box, it provides attributes that facilitate certification. By design, Rust restricts certain low-level operations and enforces strict memory safety rules, effectively shifting much of the error-checking and verification into compile-time. This means that issues that might otherwise be found by multiple external tools in C/C++ are caught early during the Rust build process. I think your link agrees with me, actually.
- steveklabnik 10mo ago
  https://ferrocene.dev/ https://ferrocene.dev/ DO-178C isn’t there yet, but I believe I heard that it’s coming. In general, Ferrous Systems works with customer demand, which has been more automotive to start.
  - irishcoffee 10mo ago
    I believe is may come, that would be really neat. Actually having it happen, someone is going to be out 10-30 million bucks. And again for each new compiler version.
    - steveklabnik 10mo ago
      Qualifying Ferrocene was way, way, way less expensive than that, and they've already had multiple versions of Rust qualified. The incremental qualifications are even easier and cheaper than the initial one is.
      - irishcoffee 10mo ago
        26262 is a lot less expensive than DO-178.
        steveklabnik 10mo ago
        I'd believe it, but from talking about this with the Ferrocene folks, there's just structural issues why it was much easier to qualify rustc than it has been to qualify C compilers. This is how they're able to offer the product at a significantly lower price point, and how they've been able to fairly regularly re-qualify new versions quickly. It is certainly non-trivial.
- monocasa 10mo ago
  > With developments such as the Ferrocene-qualified compiler, Rust can now meet all the analysis requirements under DO-178C, one of the most stringent safety-critical standards worldwide.
  - irishcoffee 10mo ago
    “Can meet” vs “has met” is the entire difference. Clearly C “can meet” and “has met” DO-178. So, I posit that more languages than C “can meet” this standard. Proving it is the very hard, very expensive part. Oh, and whatever version of the rust compiler that gets certified will be locked down as the only certified toolchain. No more compiler updates every 6 weeks. Unless you go though the whole process again.
    - steveklabnik 10mo ago
      Ferrocene has qualified Rust 1.68.2, 1.76.0, 1.79.0, 1.81.0, 1.83.0, 1.86.0, 1.87.0, 1.89.0, with 1.91.0 in the upcoming release. It's not every six weeks, but it's far faster than once every three years.

ok123456 10mo ago

The DOD also made the Waterfall method THE standard software development process.

lelanthran 10mo ago
> The DOD also made the Waterfall method THE standard software development process. I'm sure they also made a few bad decisions too :-P
Koshkin 10mo ago
You mean, "DOW"
- layer8 10mo ago
  Department of Waterfall?
  - zabzonk 10mo ago
    Department of War.
    - quesera 10mo ago
      That is not the official name, and it is highly unlikely that it ever will be in the future.
      - runjake 10mo ago
        It's worth pointing out the Department of Defense was named the Department of War for over 150 years, up until 1947. https://en.wikipedia.org/wiki/United_States_Department_of_War https://en.wikipedia.org/wiki/United_States_Department_of_Wa...
        quesera 10mo ago
        True, but it required congressional approval to change the name then, and it would now as well. This congress is not likely to approve it. And the next congress, even less so. That said, "ever" is probably too strong. There's a window wherein the chaos which is currently being actively created by the US will develop to an extent that compels the US (or is sold to US voters as a necessary step) to adopt a foreign policy where it would be the more appropriate title. And if the adults can't manage that with charismatic leadership in the next election cycle or two, we could be right back here again, with quasi-legitimate geopolitical justification for the sort of big-stick wagging we see today. I honestly think this is the goal, and I'm not sure the American people are up to the challenge of preventing it.