4 ms·
Practical experience shows that once you run into even routine systems programming elements, like writing device drivers and whatnot, you eventually have to con
by weland 12y ago
Practical experience shows that once you run into even routine systems programming elements, like writing device drivers and whatnot, you eventually have to concede some safety, or end up with an unprogrammable behemoth of such baroque complexity that you likely have more security holes, just of some other kind. There has been a lot of research into this back in the 1990s; most of the useable results produced security by architecture rather than tools.
- pohl 12y agoIt's almost as if what one would want is a language where you could shrink unsafe operations to as small a footprint as possible by confining them within a block with a special keyword, like this: unsafe { … } Someone should invent such a thing. Edit: …yeah, I was being tongue-in-cheek. This is exactly what Rust provides. http://doc.rust-lang.org/rust.html#unsafety http://doc.rust-lang.org/rust.html#unsafety "...When a programmer has sufficient conviction that a sequence of potentially unsafe operations is actually safe, they can encapsulate that sequence (taken as a whole) within an unsafe block. The compiler will consider uses of such code safe, in the surrounding context…"
- ygra 12y ago- http://msdn.microsoft.com/library/chfa2zb8.aspx http://msdn.microsoft.com/library/chfa2zb8.aspx - http://doc.rust-lang.org/rust.html#unsafe-blocks http://doc.rust-lang.org/rust.html#unsafe-blocks
- Touche 12y agoIf I call a function that is running unsafe { } inside of it, do I know? Because I really want to know. And I want my function to be marked as unsafe as well (because it is) as well as any function calling my function, etc.
- steveklabnik 12y agoYou don't know, but you can use a compiler flag that will tell you if you are. > I want my function to be marked as unsafe as well (because it is) This misunderstands the nature of `unsafe`. `unsafe` means "I promise that this is actually safe, even thought it can't be inferred." Take, for example, a type which has mutable, shared state, but enforces all access through a mutex[1]. This type presents a safe interface, but the compiler can't know that it's safe, so you have to use `unsafe` internally. 1: http://static.rust-lang.org/doc/master/std/cell/struct.RefCell.html http://static.rust-lang.org/doc/master/std/cell/struct.RefCe...
- kibwen 12y agoThe way that you mark a function as unsafe is to stick a keyword in front of it: unsafe fn foo() { ... } Any function marked as such is then allowed to call other unsafe functions: unsafe fn bar() { foo(); } But there is a way to break the chain, which is to use an `unsafe` block without marking your function as unsafe: fn qux() { unsafe { bar(); } } That said, it's incorrect to think that Rust is any more unsafe than any other language because of this; most languages simply defer this behavior to their FFI. By pulling it into the language itself, Rust is actually safer than e.g. calling C from Python, because Rust can do the low-level fiddling while still retaining at least some of the safety checks of normal Rust code. Even unsafe Rust is safer than C.
- steveklabnik 12y ago> Even unsafe Rust is safer than C. This is an important point. `unsafe` blocks only let you do a few extra operations[1], not anything you want. A lot of safety checks still happen inside of unsafe blocks. 1: http://static.rust-lang.org/doc/master/rust.html#behavior-considered-unsafe http://static.rust-lang.org/doc/master/rust.html#behavior-co...
- kibwen 12y agoWell, no, you can still theoretically do anything you want, you just need to be very, very explicit about it. :)
- dbaupp 12y agoSome things are undefined behaviour[1]... so you really don't want to want to do them (i.e. you can do them inside `unsafe`, but the compiler optimises/reasons assuming they never happen: if they occur at all, you could have an arbitrarily broken program). [1]: http://doc.rust-lang.org/master/rust.html#behavior-considered-unsafe http://doc.rust-lang.org/master/rust.html#behavior-considere...
- kibwen 12y ago
- pcwalton 12y ago> If I call a function that is running unsafe { } inside of it, do I know? Because I really want to know. Pretty much every function is going to be transitively running unsafe code, since the core libraries use it to implement the base primitives.