Hacker News Reader

Comment by sidlls | Hacker News Reader

This is actually something about the code samples in Rust docs that irks me a bit.

My view is that sample code such as this should be as idiomatic as possible and that means providing a sample demonstrating a typical real use case. So seeing "unwrap" in this context doesn't sit well with me.

In fairness, this isn't specific to Rust. I find sample code like this in many projects regardless of language. However Rust is billing itself as a safe systems programming alternative to C and C++. It would help its marketing efforts, in my opinion, by having more robust samples than the competition. And let's be honest: given the competition is C and C++, that's a low, low bar--and this comes from a guy who's about as big a fanboy of those two languages as possible.

Edit for more disclaimer: documenting Rust code is a real pleasure. The team has done a stellar job at making documentation an easy thing to do while writing the code. It's already better in most cases than many other projects I can think of.

View on HN

If the bind fails, panic seems totally appropriate. Bonus points for telling me it failed for EADDRINUSE. This is head and shoulders above anything C could deliver IMO. It's a fair debate whether we should prefer the simplicity of panic over the elegance of unwinding and handling.

So, to be clear, unwrap is safe. It is never going to cause the sorts of memory issues that an uncontrolled crash is.

That is, in terms of safety, this is the same thing as explicitly handling the error and then terminating the process. Which is the only real way you're going to handle this error anyway, unless you wanted some sort of retry logic. Which you might!

I agree that in terms of safety it's equivalent. However in terms of how an actual program would be written it's...Less than optimal. I almost never simply allow a panic-like termination in a program like this, if it can be trapped, without doing something else, even if it's just to spit out a log/stdout message with a descriptive reason. Then again the plural of anecdote isn't data, and maybe I'm the oddball here.

Yeah, unwrap()s in examples should be written to use expect() (which spits a message and then panics).

But for most example programs there's no easy way to handle errors further than just using expect() unless you want there to be more error handling code than actual useful example code.

Rust n00b here (I read a lot about it but haven't written a line yet), but wouldn't `.orPanic('error message')` be a better name than `.expect('error message')`? The latter seems backwards.

It'd be or_panic, following conventions.

The idea is that I expect this to be Ok/Some, and if it's not, please use this error message.

I understand the intent, but usually the programmatic object is the subject of the sentence, the method is the verb and the parameter/argument is the grammatical object.

Here, the programmatic object is the grammatical object. That's what I meant by 'backwards'.

could_fail().or_panic_with('message') may be even better.

I don't neccesarily disagree. Names are hard :)

A lot of people don't seem to agree with me but I think even expect is too long of a name and terseness for commonly used names seems more important to me than reading like natural language.

You shouldn't really be using expect much :)

It's true I use and see unwrap more.

That's not good either :|

unwrap should be confined to test and temporary code. It somewhat makes sense in example code, but expect is better for that.

There are sometimes cases when you very easily know that the unwrap will never fail and if it does something has gone very horribly wrong, in which case you might use it.

Libraries should keep usage of unwrap/expect to a minimum. Applications can be more liberal with it, but they should try to use expect or better error handling.

Not everyone perfectly follows this, sadly. But most do.

It's at least partly a matter of affordance. You could soft-deprecate .unwrap() and .expect() (emit warnings at compile time, it will be annoying but not fatal), and provide a new version of expect with a name that's more cumbersome to type (or_panic_with(...) isn't bad in that regard, but you could do even worse... or_panic_with_error_message(...) :-).

I don't think terseness helps much here, isn't the actual error message gonna dwarf the name of the method it's passed to in almost all scenarios?

> even if it's just to spit out a log/stdout message.

This will print an error out already.

  $ ./target/debug/tokiotest
  thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Error { repr: Os { code: 98, message: "Address already in use" } }', ../src/libcore/result.rs:837

Printing out a _better_ error might be helpful, though, I'll agree :) You could use expect for that, which lets you change the message in the ''s easily.

This really shows a fundamental tension though, in documentation. Is this example supposed to be demonstrating error handling? Or just get you going? Does adding more complex error handling distract from the point it's trying to teach? These are sort of open-ended questions.

The output of panic! seems to be useful only to the programmer, not the user. As a user, getting an error message like that would lead me to think that the application is defective, as it arguably is if it cannot provide better user experience in a completely expected error condition like a port being already in use.

Absolutely. Your users aren't likely to be seeing a server-side process like this fail, though, so in this situation, seems fine.

As I said in the post you're replying to, a nicer error message would be a good thing.

> Your users aren't likely to be seeing a server-side process like this fail, though, so in this situation, seems fine.

Whoever maintains the server and runs the service is also my user, though, in the general case.

> As I said in the post you're replying to, a nicer error message would be a good thing.

Yeah - I don't mind if unwrap panics with a dev-oriented message as it's basically an assertion, but I guess I expected expect() (no pun intended) to give a more user-friendly error. Maybe the format of the panic! output could be changed to bring the message to the front and the technical details after that.

In the world of server systems programming once an organization gets beyond a certain size it's uncommon to have programmers administering server daemons or other server applications. Those folks are indeed users.

See my sibling comment to the above. By the time your software has matured enough that it's been deployed to non-developers, unwraps have no place in the code. It's not an error-handling strategy, it's just "// TODO: Add error handling" that the compiler understands.

Example code should be exemplary.

As I said elsewhere, exemplary of what? The concept, or robust error handling? Even with the latter, it's unclear what the _right_ error handling is without knowing what you're actually doing.

The output of panic will only ever be seen by the programmer. Unwrap exists to ease prototyping and to make simple code examples. IME, the first thing you do when you take a Rust application from the prototype phase to the production phase is to grep for unwraps and insert proper error handling.

> The output of panic will only ever be seen by the programmer.

Obviously not if it's used for input errors (network failure). Crashing assertions are made for bugs, not input errors.

Please read the rest of my comment. It's not used for input errors.

This is invalid since nothing in the compiler forces you to remove the .unwrap() so it's safe to assume it will not be done before production. The whole "but this is just for prototyping" is a logical fallacy, as you know we have tons of prototypes in production ;)

I admit that I'm having a hard time seeing this criticism as anything but overblown. Finding usage of unwrap is trivially easy via textual search. Furthermore, Clippy can be used to automatically forbid usage of unwrap for your entire team ( https://github.com/Manishearth/rust-clippy/wiki#option_unwra... ). Furthermore, even when you hit a panic, it tells you which line of code in which file triggered it so that you can fix it immediately. Furthermore, the Rust community has a strong and long-entrenched proscription against libraries which unwrap rather than handle errors.

We can agree in the cynical interpretation of the laziness of programmers, but the mitigations in this case are so trivial, and the stakes so low, that focusing on unwrap as a point of contention is a poor use of energy.

Wasn't there an attempt to get a variation of main that returned result at one point(that would presumably print error and set exit code one error)? Back before "?"

If rust had that examples would be even shorter using ? Instead of try! or unwrap

Yes, and that discussion is still ongoing. The devil, as always, is in the details.

`-> impl Trait` seems useful in that context, so that main could have a variety of appropriate return value types: `()`, `i32` (for an exit code), or `Result<T, E>` where T implements ReturnValue and E implements Error.

`quick_error` uses a trait like that to determine the exit code of `main()`, allowing it to return either () or i32.

FWIW there are third-party libraries which include that feature e.g. error_chain has a `quick_main` macro (working with its `error_chain!`-generated error, but I'm not sure it actually depends on it):

    quick_main!(|| -> Result<()> {
        // insert Result-returning code here
    });

Alternatively it takes a few lines to bootstrap it by hand e.g. ripgrep uses this code to bootstrap:

    fn main() {
        match Args::parse().map(Arc::new).and_then(run) {
            Ok(0) => process::exit(1),
            Ok(_) => process::exit(0),
            Err(err) => {
                eprintln!("{}", err);
                process::exit(1);
            }
        }
    }

https://github.com/BurntSushi/ripgrep/blob/master/src/main.r...

Agreed. Looking for examples of how to handle errors, results, etc and only ever finding unwrap has frustrated me in the past, and as a noob I would have preferred fleshed out rather than shortcuts.

https://doc.rust-lang.org/stable/book/error-handling.html goes into fairly extreme level of details about this, if you're still trying to learn.

http://rust-lang.github.io/book/ch12-03-improving-error-hand... shows how to refactor a project to improve its error handling as well, for something a bit less abstract.

Sometimes a little context can be helpful.

Doing anything other than a crash is often sub-optimal, in my experience.

Such error handling code is usually untested, which is another way of saying 'buggy'. It almost always swallows useful information, like the backtrace. It sometimes lets program execution continue in a messed up state, causing very strange and hard to debug errors later on.

Certainly Rust makes it a lot harder to mess up error handling code than the languages I'm used to but in general I'm definitely in the 'all exceptions fatal' camp.

An exception to the exception rule IMO is a program that is managing many internal tasks at once, and the failure of one should not bring down the others. For example, a program that is coordinating many IoT devices should not fail if one of those devices cannot be contacted.

In the case of unreliable network peers, it isn't really "exceptional" that they be unreachable. It should just be represented as data.

This poses an interesting question: how hard is it in rust to enumerate all possible error sources from some code?

The mention of memory safety is kind of weird. Reading or writing to -1 in C is memory safe too. It's even sometimes done deliberately as a debug technique if you want to insert messages in your IO traces. (Wrt your post that rust is more than just safety, people will get that impression when you introduce memory safety into unrelated threads.)

While Rust is more than memory safety, it's really important that people accurately understand what safety actually means in Rust. Because then they oversell it. Common misunderstandings here:

* Rust prevents deadlocks

* You can't leak memory in Rust

* Rust prevents race conditions

* Panic is not safe

etc. In my mind, bringing up memory safety here isn't a red herring; the parent said this:

> However Rust is billing itself as a safe systems programming alternative to C and C++.

The way in which we are safer is memory safety, nothing more. And knowing that is crucial.

Rust code will have bugs. Rust code will have security vulnerabilities. Rust is not a panacea.

> The way in which we are safer is memory safety, nothing more.

I know you want to not overstate rust's claims given recent articles, but I think you're actually underselling a little here. For example, a rust `enum` make it much easier for the compiler to enforce code correctness. It's hard to go back to similar code in C or Go once you've gotten used to `match`.

Yes, I guess in my mind, "correctness" and "memory safety" are two different things. I like that Rust can help you write more correct software, but it's not nearly as strong of a guarantee as our memory safety guarantees are.

The Rust frontpage is kind of promoting these misunderstandings: https://www.rust-lang.org/en-US/index.html

> prevents segfaults

Only outside unsafe blocks.

> guarantees thread safety.

But you just said you can have deadlocks and race condition, so... perhaps change the frontpage?

The guarantees Rust makes are always only outside of unsafe blocks. After all, you can call C code in unsafe blocks. :)

The page clarifies later on that the definition of thread safety in question is "threads without data races." The 16 words on the front page of the website are not the appropriate place to go into caveats and nuances.

The urge to write something clear and short should not lead to write a false fact. Or at least have asterisks.

We've tried to come up with something succinct to replace "thread safety", but it's tough.

> Only outside unsafe blocks.

This is just true of all of our guarantees. Given that the vast, vast, vast, vast majority of Rust code is safe code, I don't feel this is misleading. Do you say that Ruby doesn't prevent segfaults due to its C FFI?

I don't see an inaccurate statement on the Ruby frontpage: https://www.ruby-lang.org/fr/

edit: I'm just saying "don't lie". I shouldn't have to defend this view point and get downvotes for it.

It's not a lie. Terminology has nuance, and its meaning may change based on context.

Look, it's really really simple.

1/ It says on the tin "prevents segfaults". It does not prevent segfaults in all cases, but OK, let's debate the other claim.

2/ It also says "guarantees thread safety". What is the Wikipedia definition of thread safety? It varies, so let's take the most common "freedom from race conditions."

Steve come and say Rust can have race conditions https://news.ycombinator.com/item?id=13376485 and that it's a common misunderstanding to think it prevents race conditions. Surely it would be great if the frontpage would not promote it!

Ergo the frontpage claim is false.

I disagree with the segfaults bit (which is what you had been focusing on so far, and which is what I've been arguing against) but yeah, "guarantees thread safety" is iffy.

The wikipedia definition is pretty vague, it relies on a concept of "safe" that isn't defined there. It's acceptable to say that "data race safety" is "thread safety", though confusing. Rust's homepage does clarify what it means in the bullet points below that statement, so I wouldn't call this a lie. It may be misleading though, and this is a common misunderstanding as steve mentioned, so I submitted a PR to fix it https://github.com/rust-lang/rust-www/pull/685

Yes I think "data race freedom" when I see "thread-safety" (I despise this one term for being so vague).

In the punchline, "prevent segfaults" is framed in negative terms. If you put "provides memory safety" it will be a bit less evocative of specific pain, but will give a warm feeling.

https://github.com/rust-lang/rust-www/pull/685#issuecomment-...

Not too sure of the segfaults bit, feel free to put in your thoughts on that PR

Yes, to second Manish, I would love to find something that is accurate, succinct, and understandable. Concrete suggestions (from you or anyone else) very welcome.

My attempts so far:

Rust is a systems programming language that runs blazingly fast, guarantees memory safety and provides correct concurrency.

Rust is a systems programming language that provides uncompromised performance, convenience and security.

Rust is a systems programming language that enables unprecedented levels of performance, productivity and safety.

edit: I like (2) best

> Only outside unsafe blocks.

This is a relatively uninteresting quibble: the guarantees of any language only apply outside their equivalent of unsafe blocks (e.g. Python is memory safe... until you use ctypes). Pretty much everything has a way to FFI down to interact with the machine; in Rust, it's just called `unsafe`.

(One way to look at `unsafe` is that it's a tightly integrated FFI to another language called "unsafe Rust", and it benefits from having zero performance or semantic overhead.)

Python doesn't market itself by telling it's memory-safe https://www.python.org/

If a language frontpage is inexact I'll assume the rest of the website is inexact, simple as that.

His point is that in the world of programming languages, "true memory safety" isn't really something achievable without making it impossible for your language to interact with things like native libraries or the OS. Given this, the concept of "true memory safety" isn't a useful one. In general when you say a language is memory safe, there's an implicit caveat that there may be explicit escape hatches. No language (except perhaps web-based JS) is "memory safe" by the strict definition so it's not a useful parameter to use when talking of languages. You instead use the weaker version.

Terminology matters.

Can't tell if trolling or not. Python doesn't market itself as memory-safe because it's completely expected that scripting languages are memory-safe. The only domain where memory safety isn't taken as given is in systems programming, which is why Rust's safety guarantees are a big selling point.

Not trolling. I'm just trying to convey a simple point. https://news.ycombinator.com/item?id=13378183

As it cost me 20+ downvotes to make a rational conversation with you all, I will stop interacting with the Rust community.

Firstly, the frontpage isn't promoting the misunderstandings in Steve's comment, it's promoting a different (uncommon) misunderstanding.

As I mentioned in https://news.ycombinator.com/item?id=13377957, in the world of programming languages, the term "memory safety" means something specific.

D calls itself safe on its website, but it too has the ability to escape-hatch into C/C++.

Language websites putting forth subjective claims or claims based on definitions which may be subjective is totally normal:

Go says that it "makes it easy to build simple, reliable, and efficient software", which is totally subjective.

Ruby says "It has an elegant syntax that is natural to read and easy to write.", also subjective.

Python says "lets you work quickly and integrate systems more effectively", also subjective.

I get what you are saying. What strikes me as different in the other frontpages are: the claims are made in terms vague enough to be unassailable.

You seem to be saying that because Rust is able to provide stronger guarantees, it should make weaker claims on its main page. But just because some of Rust's benefits are verifiable, unlike those of some other languages, doesn't mean the constraints on them need to be enumerated every time they're expressed. This is not "lying."

By the same token, you should be requiring that every subjective statement on the other langs' pages have the caveat "in the opinion of the $LANG developers." Obviously no one would wear that.

"thread safety" and "memory safety" are vague terms. "thread safety" is clarified there. "memory safety" has a particular meaning in that context which is true for Rust.

> The mention of memory safety is kind of weird.

While teaching Rust it's a recurring theme among students to believe that all crashes are created equal and that an exit from a panic must be equivalent to a segfault, despite this being significantly false. So it's common when discussing panics to novice audiences to sprinkle in "by the way, this isn't a crash, it's a controlled exit".

> Reading or writing to -1 in C is memory safe too.

Is it? It's out of bounds of any object, and therefore undefined behavior.

File descriptor -1, as in the same thing we're unwrapping in the rust code. In C, if socket() returns -1, that's actually a monad that you can pass to bind() and listen() and accept() and then check for errors. :)

FWIW it's unwrap()ing on a known-good address, which is an okay way to use unwrap(). Kind of.

It's one of the more common ways of using unwrap.

(The examples unwrap elsewhere in less known-good scenarios, I agree that we should improve there)

> My view is that sample code such as this should be as idiomatic as possible and that means providing a sample demonstrating a typical real use case. So seeing "unwrap" in this context doesn't sit well with me.

I've starting trying to use `if let Some/Ok(...) = ...` in examples for my projects rather than `unwrap` for pretty much this reason. I feel like it strikes a pretty good balance between providing a relatively terse example without the risk of implying that `unwrap/expect` is considered normal usage for the library.

Reply on news.ycombinator.com