5 ms·
Oh oh, who would have thought. A memory-safe rust at last. With no unsafe allowed, even type safe. Unless you forget about their type bugs: https://github.com/
by rurban 6mo ago
Oh oh, who would have thought. A memory-safe rust at last.
With no unsafe allowed, even type safe. Unless you forget about their type bugs: https://github.com/Speykious/cve-rs https://github.com/Speykious/cve-rs.
So maybe eliminate type and concurrency unsafeties also then in the next decades or so.
- bayesnet 6mo agoThe existence of a soundness bug in the typechecker doesn’t refute the value of soundness as a language design contract. If anything it’s the opposite: issues demonstrated by cve-rs are _language bugs_ and are _fixable_ in principle. “Safe Rust should be memory-safe” is a well-defined, falsifiable contract that the compiler can be measured against. Meanwhile memory unsafety is a feature of the semantics of C++ and so it would be absurd to file a bug against gcc complaining that it compiled your faulty code.
- rurban 6mo agoThe language design contract is unsafe by default. In memory, types and concurrency. What are you talking about? There are unsafe blocks all over the stdlib. And concurrency safety would need to get rid of their blocking IO, which they haven't even acknowledged.
- quotemstr 6mo ago> There are unsafe blocks all over the stdlib Physics is unsafe. Something, somewhere needs to provide the safe core. > And concurrency safety would need to get rid of their blocking IO, which they haven't even acknowledged. Is your position that blocking IO can't be compatible with concurrency safety? That's a strange claim. Can you explain?
- rurban 6mo agoSure, but then they shout all over how safe they are. They got rid of the safeties pretty late, when they ripped out their GC, but kept their false promises all over. No, that's common knowledge. I fixed concurrency safety by forbidding blocking IO. Others also. Maybe there are other ways, but never heard of other ways.
- quotemstr 6mo agoHuh? It doesn't follow that forbidding blocking IO is either necessary or sufficient for concurrency safety, at least under any definition of "safety" I can imagine. What do you mean? You mean async-not-blocking-event-loop stuff? That's not the only way to do more than one IO at a time.
- rurban 6mo agoNon-blocking IO is only one part to provide concurrency safety. Process locks are even worse. All locks are forbidden to avoid dead-locks.
- aw1621107 6mo ago> They got rid of the safeties pretty late, when they ripped out their GC, but kept their false promises all over. This seems like a non-sequitur to me? The presence/absence of a GC is not dispositive with respect to determining "safety", especially when the GC itself involves unsafe code.
- rurban 6mo agoHave you ever seen a GC system with memory unsafeties? I cannot remember any
- afdbcreid 6mo agoAh. I believe pretty much every safe language on the planet constantly has bugs in the implementation that can be exploited to cause unsafety. Sometimes they even get CVEs, e.g. in JavaScript VMs.
- rurban 6mo agoI don't do Javascript, but any self-respecting language which calls itself safe is actually safe. I worked for decades in actually memory and type safe languages, and never ever heard of a memory or type safety bug. Just not the cheaters: Rust, Java (until recently), and of course Javascript with its unsafe implementations. Memory safety bug in a proper lisp? Unheard of, unless you break the GC or do wrong FFI calls.
- mamcx 6mo ago> The language design contract is unsafe by default False. The language design safe by default, something that you can confirm super easily doing just the Rust tutorials and compare the same with C or C++. Read the repo well: cve-rs implements the following bugs in safe Rust: Use after free Buffer overflow Segmentation fault NOT REFUTE IT. > There are unsafe blocks all over the stdlib Unsafe blocks is not the same that unsafe code. Are marked areas that are required to do escape automated checks, and there, you are at the level of a C/C++ programmer (where in that languages ALL THE CODE IS MARKED UNSAFE). If you complaint against that, is the same as complaint against ALL THE CODE writer on C/C++. --- One thing important to understand about Rust: Rust is a system language and SHOULD be able to implement everyting including, Buffer overflow, Use after free , Segmentation fault and such. You should be able to implement a terrible OS, malware, faulty drivers, etc, minimally because that is required to test safe programs! (example: Deterministic Simulation Testing https://turso.tech/blog/introducing-limbo-a-complete-rewrite-of-sqlite-in-rust https://turso.tech/blog/introducing-limbo-a-complete-rewrite...). But what Rust gives is that not assume that you want to do it for most programs.
- pjmlp 6mo agoIt is called OCaml, for those that want it.
- marcosscriven 6mo agoI see you’ve been downvoted, but honestly this is news to me. I see that repo is two years old - are there flaws in Rust that aren’t edge cases that would make it not memory safe?
- rurban 6mo agoSure, besides those bugs, read the specs. unsafe blocks. Loud and clear. worse than in Java where the unsafeties were just in a hidden sun class.
- marcosscriven 6mo agoI was familiar with the concept of unsafe blocks. What I didn’t know was there were issues outside that.
- adastra22 6mo agoI don’t know what your point is. Unsafe blocks in the stdlib isn’t a gotcha. It’s the whole point of unsafe: you provide a validated and ideally proveably correct implementation once, with a safe wrapper. It’s how everything is implemented under the hood. It’s like double entry accounting when you only have one pen and one writing hand. The system is broken if you ever write down only half of a transaction in one ledger: you always need to record both the flow in and flow out on both ledgers. Writing either one of them is an unsafe operation. But you can only write one thing at a time. So write them in pairs in an unsafe {} block, and reuse that block safely.
- rurban 6mo agoSo you are fine in calling a language "safe", when it has unsafe blocks, which the compiler skips to check? You have to that manually, and then you are back in C++ land. That's hilarious. You can call it somewhat safe, or mostly safe, but never safe.
- sfink 6mo agoAlternatively, you can have a fully safe language, and then to get certain things done you add fundamentally unsafe FFI[1]. Or you use IPC to a process written in an unsafe language. Again, you're "back in C++ land". It seems like your complaint is that Rust is referred to as a safe language. Which is fine; it's more correct to use the phrase "in safe Rust" rather than assuming that "in Rust" fully implies "safe". That is true, but that's a crack in a sidewalk compared to the chasm of difference between Rust and C++. Why obsess over that crack? Should we all refer to "Python without FFI or any extensions written in C or another unsafe language" instead of "Python", to avoid asserting that Python-as-it-is-used is a safe language? [1] Assuming it's FFI to an unsafe language, and that's the main purpose of FFI.