9 ms·

Here's Linus' take: You need to realize that (a) reality trumps fantasy (b) kernel needs trump any Rust needs And the reality is that th

Here's Linus' take: You need to realize that (a) reality trumps fantasy (b) kernel needs trump any Rust needs And the reality is that there are no absolute guarantees. Ever. The "Rust is safe" is not some kind of absolute guarantee of code safety. Never has been. Anybody who believes that should probably re-take their kindergarten year, and stop believing in the Easter bunny and Santa Claus. https://lkml.org/lkml/2022/9/19/1105#1105.php https://lkml.org/lkml/2022/9/19/1105#1105.php If you cannot get over the fact that the kernel may have other requirements that trump any language standards, we really can't work together. https://lkml.org/lkml/2022/9/19/1250 https://lkml.org/lkml/2022/9/19/1250

ducktective 4y ago
> The "Rust is safe" is not some kind of absolute guarantee of code safety Exactly. Some people act like we don't have the whole branch of "formal proofs" in CS. Memory safety is just once aspect of program safety. Like, IMO, programs written in Coq, F* or even C programs verified by Frama-C are much more "safe" than Rust programs that advertise their "safety" on the mere fact that they are written in Rust.
- UltraViolence 4y ago
  The reality is that people are adding critical code to the kernel and surrounding infrastructure (OpenSSL) on a Friday night after a long weeks work and never bother to look at it again. We absolutely need something like Rust to cover our backs!
  - pclmulqdq 4y ago
    The idea that Rust can solve this problem is ridiculous to me. The types of bugs that sleep-deprived contributors writing fire-and-forget code will make will just shift to something that the borrow checker doesn't help with.
    - UltraViolence 4y ago
      It's not ridiculous, it's a proven fact! Rust obviously won't stop logical errors, but it will put an end to the almost unending cue of memory and thread related bugs. Mind you that Firefox, for example, has been around for 17 years. Every month I get security updates fixing multiple memory holes in the code each of which could potentially allow anyone to take over my machine. Seventeen years!! They must have fixed hundreds if not thousands of such bugs by now, and every month more are repaired by updates. We'd have none of those had it been written in Rust. Also mind the time saved by developers not having to hunt for such (hard to track down) bugs!
      - cesarb 4y ago
        > We'd have none of those had it been written in Rust. Except for memory issues in JIT-generated code from Javascript? Not all browser vulnerabilities are caused by memory safety issues in the code generated by the Javascript JIT, but several of them are (particularly "type confusion" vulnerabilities). Rust might help avoid vulnerabilities in the code generator, but not in the generated code.
    - unrealhoang 4y ago
      So, no bug that the borrow checker can help with? Sounds like a big win to me, why is it ridiculous?
      - pclmulqdq 4y ago
        The parent comment implied that this meant that there would be fewer bugs. That is definitely not what happens. The factor that actually generates the bugs is the tired person writing code they will never read again or use. The borrow checker won't help with that. I write code with different types of bugs in C, Go, Rust, Javascript, and Verilog, for example. I rarely write code with no bugs, especially when I have no real connection to the code.
        unrealhoang 4y ago
        GP comment implied there would be fewer exploitable bugs. That is definitely what happens. If you think there's the same amount of severe exploit from software written in Go/Java/Javascript and software written in C/C++, you are just factually wrong. 70% of exploitable bugs from large company products (M$, Apple, Google) ARE memory safety bugs.
- arunc 4y ago
  FWIW, Walter Bright have been, for years, proposing the C standard to fix the billion dollar mistake in a backwards compatible way. Stroustrup is the head of the C standards committee, just saying.
  - pjmlp 4y ago
    Stroustrup voice counts one vote like everyone else on ISO C++, doesn't matter what role he played on the language creation. Also the current head of the standards comittee is Herb Sutter.
  - belgesel 4y ago
    Can you elaborate on that, couldn't find the proposal, I want to learn more about it.
  - eps 4y ago
    Typo? Stroustrup is not even a member of the C standards committee.
elktea 4y ago
I'm not sure how this relates to the post, can you elaborate?
- ziddoap 4y ago
  One is a post about Rust in the Linux kernel, and the other is Linus talking about Rust in the Linux kernel on LKML. What would you like elaboration on? The relationship seems pretty clear to me?
- bayindirh 4y ago
  Many of the Rust "evangelists" thinks/behaves like Rust's guarantees are absolute and leads to absolutely unbreakable software by default, and advocate that the language is the silver bullet combining abilities of C, C++ (depending on application) without any of their downsides. When you hit a limitation you really need to implement in Rust, they say "Hey, there's unsafe{}, use that". Also, they advocate that unsafe{} is equal to C/C++ in programming freedom, which is again not. When they're reminded that reality is not like that, they get upset and defensive. This comment is a nice flag to remind this reality. I congratulate Rust for being what it is, but it's not a silver bullet and it's not the next C or C++. It's just a very nice programming language for various applications. Being all shiny-eyed doesn't work in CS or programming in general, and also hardware doesn't work like that (a deterministic, perfectly good behaving, spec-obeying magic box with some included smoke for higher performance).
  - sebzim4500 4y ago
    >Many of the Rust "evangelists" thinks/behaves like Rust's guarantees are absolute and leads to absolutely unbreakable software by default, and advocate that the language is the silver bullet combining abilities of C, C++ (depending on application) without any of their downsides. Where are these people? I'm not doubting that they exist, but I've never come across one and I've been in the rust community for several years now.
  - howinteresting 4y ago
    This is misunderstanding the point of unsafe. All memory-safe languages in existence have safe abstractions built around unsafe code. For example, most JavaScript runtimes are written in C++. The point of unsafe Rust is to be able to use the same language to write both safe and unsafe code. On the flip side, almost all C and C++ is unsafe code. The point of unsafe Rust is to be able to reserve brainpower for small subsets of code while having a relaxed posture towards most of it.
deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
shp0ngle 4y ago
Those posts are actually more substantive and less negative than they might seem from these blurbs. It’s not that Linus is against Rust at all, just clearing up some disagreements.
phist_mcgee 4y ago
I see Linus has slightly tone down his ad hominem, but it's certainly still linus typing these words.

ducktective 4y ago

> The "Rust is safe" is not some kind of absolute guarantee of code safety Exactly. Some people act like we don't have the whole branch of "formal proofs" in CS. Memory safety is just once aspect of program safety. Like, IMO, programs written in Coq, F* or even C programs verified by Frama-C are much more "safe" than Rust programs that advertise their "safety" on the mere fact that they are written in Rust.

UltraViolence 4y ago
The reality is that people are adding critical code to the kernel and surrounding infrastructure (OpenSSL) on a Friday night after a long weeks work and never bother to look at it again. We absolutely need something like Rust to cover our backs!
- pclmulqdq 4y ago
  The idea that Rust can solve this problem is ridiculous to me. The types of bugs that sleep-deprived contributors writing fire-and-forget code will make will just shift to something that the borrow checker doesn't help with.
  - UltraViolence 4y ago
    It's not ridiculous, it's a proven fact! Rust obviously won't stop logical errors, but it will put an end to the almost unending cue of memory and thread related bugs. Mind you that Firefox, for example, has been around for 17 years. Every month I get security updates fixing multiple memory holes in the code each of which could potentially allow anyone to take over my machine. Seventeen years!! They must have fixed hundreds if not thousands of such bugs by now, and every month more are repaired by updates. We'd have none of those had it been written in Rust. Also mind the time saved by developers not having to hunt for such (hard to track down) bugs!
    - cesarb 4y ago
      > We'd have none of those had it been written in Rust. Except for memory issues in JIT-generated code from Javascript? Not all browser vulnerabilities are caused by memory safety issues in the code generated by the Javascript JIT, but several of them are (particularly "type confusion" vulnerabilities). Rust might help avoid vulnerabilities in the code generator, but not in the generated code.
  - unrealhoang 4y ago
    So, no bug that the borrow checker can help with? Sounds like a big win to me, why is it ridiculous?
    - pclmulqdq 4y ago
      The parent comment implied that this meant that there would be fewer bugs. That is definitely not what happens. The factor that actually generates the bugs is the tired person writing code they will never read again or use. The borrow checker won't help with that. I write code with different types of bugs in C, Go, Rust, Javascript, and Verilog, for example. I rarely write code with no bugs, especially when I have no real connection to the code.
      - unrealhoang 4y ago
        GP comment implied there would be fewer exploitable bugs. That is definitely what happens. If you think there's the same amount of severe exploit from software written in Go/Java/Javascript and software written in C/C++, you are just factually wrong. 70% of exploitable bugs from large company products (M$, Apple, Google) ARE memory safety bugs.
arunc 4y ago
FWIW, Walter Bright have been, for years, proposing the C standard to fix the billion dollar mistake in a backwards compatible way. Stroustrup is the head of the C standards committee, just saying.
- pjmlp 4y ago
  Stroustrup voice counts one vote like everyone else on ISO C++, doesn't matter what role he played on the language creation. Also the current head of the standards comittee is Herb Sutter.
- belgesel 4y ago
  Can you elaborate on that, couldn't find the proposal, I want to learn more about it.
- eps 4y ago
  Typo? Stroustrup is not even a member of the C standards committee.

elktea 4y ago

I'm not sure how this relates to the post, can you elaborate?

ziddoap 4y ago
One is a post about Rust in the Linux kernel, and the other is Linus talking about Rust in the Linux kernel on LKML. What would you like elaboration on? The relationship seems pretty clear to me?
bayindirh 4y ago
Many of the Rust "evangelists" thinks/behaves like Rust's guarantees are absolute and leads to absolutely unbreakable software by default, and advocate that the language is the silver bullet combining abilities of C, C++ (depending on application) without any of their downsides. When you hit a limitation you really need to implement in Rust, they say "Hey, there's unsafe{}, use that". Also, they advocate that unsafe{} is equal to C/C++ in programming freedom, which is again not. When they're reminded that reality is not like that, they get upset and defensive. This comment is a nice flag to remind this reality. I congratulate Rust for being what it is, but it's not a silver bullet and it's not the next C or C++. It's just a very nice programming language for various applications. Being all shiny-eyed doesn't work in CS or programming in general, and also hardware doesn't work like that (a deterministic, perfectly good behaving, spec-obeying magic box with some included smoke for higher performance).
- sebzim4500 4y ago
  >Many of the Rust "evangelists" thinks/behaves like Rust's guarantees are absolute and leads to absolutely unbreakable software by default, and advocate that the language is the silver bullet combining abilities of C, C++ (depending on application) without any of their downsides. Where are these people? I'm not doubting that they exist, but I've never come across one and I've been in the rust community for several years now.
- howinteresting 4y ago
  This is misunderstanding the point of unsafe. All memory-safe languages in existence have safe abstractions built around unsafe code. For example, most JavaScript runtimes are written in C++. The point of unsafe Rust is to be able to use the same language to write both safe and unsafe code. On the flip side, almost all C and C++ is unsafe code. The point of unsafe Rust is to be able to reserve brainpower for small subsets of code while having a relaxed posture towards most of it.

deleted 4y ago

[deleted]

deleted 4y ago
[deleted]

shp0ngle 4y ago

Those posts are actually more substantive and less negative than they might seem from these blurbs. It’s not that Linus is against Rust at all, just clearing up some disagreements.

phist_mcgee 4y ago

I see Linus has slightly tone down his ad hominem, but it's certainly still linus typing these words.