Hacker News Reader

Comment by steveklabnik | Hacker News Reader

While Rust is more than memory safety, it's really important that people accurately understand what safety actually means in Rust. Because then they oversell it. Common misunderstandings here:

* Rust prevents deadlocks

* You can't leak memory in Rust

* Rust prevents race conditions

* Panic is not safe

etc. In my mind, bringing up memory safety here isn't a red herring; the parent said this:

> However Rust is billing itself as a safe systems programming alternative to C and C++.

The way in which we are safer is memory safety, nothing more. And knowing that is crucial.

Rust code will have bugs. Rust code will have security vulnerabilities. Rust is not a panacea.

View on HN

> The way in which we are safer is memory safety, nothing more.

I know you want to not overstate rust's claims given recent articles, but I think you're actually underselling a little here. For example, a rust `enum` make it much easier for the compiler to enforce code correctness. It's hard to go back to similar code in C or Go once you've gotten used to `match`.

Yes, I guess in my mind, "correctness" and "memory safety" are two different things. I like that Rust can help you write more correct software, but it's not nearly as strong of a guarantee as our memory safety guarantees are.

The Rust frontpage is kind of promoting these misunderstandings: https://www.rust-lang.org/en-US/index.html

> prevents segfaults

Only outside unsafe blocks.

> guarantees thread safety.

But you just said you can have deadlocks and race condition, so... perhaps change the frontpage?

> Only outside unsafe blocks.

This is a relatively uninteresting quibble: the guarantees of any language only apply outside their equivalent of unsafe blocks (e.g. Python is memory safe... until you use ctypes). Pretty much everything has a way to FFI down to interact with the machine; in Rust, it's just called `unsafe`.

(One way to look at `unsafe` is that it's a tightly integrated FFI to another language called "unsafe Rust", and it benefits from having zero performance or semantic overhead.)

Python doesn't market itself by telling it's memory-safe https://www.python.org/

If a language frontpage is inexact I'll assume the rest of the website is inexact, simple as that.

His point is that in the world of programming languages, "true memory safety" isn't really something achievable without making it impossible for your language to interact with things like native libraries or the OS. Given this, the concept of "true memory safety" isn't a useful one. In general when you say a language is memory safe, there's an implicit caveat that there may be explicit escape hatches. No language (except perhaps web-based JS) is "memory safe" by the strict definition so it's not a useful parameter to use when talking of languages. You instead use the weaker version.

Terminology matters.

Can't tell if trolling or not. Python doesn't market itself as memory-safe because it's completely expected that scripting languages are memory-safe. The only domain where memory safety isn't taken as given is in systems programming, which is why Rust's safety guarantees are a big selling point.

Not trolling. I'm just trying to convey a simple point. https://news.ycombinator.com/item?id=13378183

As it cost me 20+ downvotes to make a rational conversation with you all, I will stop interacting with the Rust community.

Firstly, the frontpage isn't promoting the misunderstandings in Steve's comment, it's promoting a different (uncommon) misunderstanding.

As I mentioned in https://news.ycombinator.com/item?id=13377957, in the world of programming languages, the term "memory safety" means something specific.

D calls itself safe on its website, but it too has the ability to escape-hatch into C/C++.

Language websites putting forth subjective claims or claims based on definitions which may be subjective is totally normal:

Go says that it "makes it easy to build simple, reliable, and efficient software", which is totally subjective.

Ruby says "It has an elegant syntax that is natural to read and easy to write.", also subjective.

Python says "lets you work quickly and integrate systems more effectively", also subjective.

I get what you are saying. What strikes me as different in the other frontpages are: the claims are made in terms vague enough to be unassailable.

You seem to be saying that because Rust is able to provide stronger guarantees, it should make weaker claims on its main page. But just because some of Rust's benefits are verifiable, unlike those of some other languages, doesn't mean the constraints on them need to be enumerated every time they're expressed. This is not "lying."

By the same token, you should be requiring that every subjective statement on the other langs' pages have the caveat "in the opinion of the $LANG developers." Obviously no one would wear that.

"thread safety" and "memory safety" are vague terms. "thread safety" is clarified there. "memory safety" has a particular meaning in that context which is true for Rust.

The guarantees Rust makes are always only outside of unsafe blocks. After all, you can call C code in unsafe blocks. :)

The page clarifies later on that the definition of thread safety in question is "threads without data races." The 16 words on the front page of the website are not the appropriate place to go into caveats and nuances.

The urge to write something clear and short should not lead to write a false fact. Or at least have asterisks.

We've tried to come up with something succinct to replace "thread safety", but it's tough.

> Only outside unsafe blocks.

This is just true of all of our guarantees. Given that the vast, vast, vast, vast majority of Rust code is safe code, I don't feel this is misleading. Do you say that Ruby doesn't prevent segfaults due to its C FFI?

I don't see an inaccurate statement on the Ruby frontpage: https://www.ruby-lang.org/fr/

edit: I'm just saying "don't lie". I shouldn't have to defend this view point and get downvotes for it.

It's not a lie. Terminology has nuance, and its meaning may change based on context.

Look, it's really really simple.

1/ It says on the tin "prevents segfaults". It does not prevent segfaults in all cases, but OK, let's debate the other claim.

2/ It also says "guarantees thread safety". What is the Wikipedia definition of thread safety? It varies, so let's take the most common "freedom from race conditions."

Steve come and say Rust can have race conditions https://news.ycombinator.com/item?id=13376485 and that it's a common misunderstanding to think it prevents race conditions. Surely it would be great if the frontpage would not promote it!

Ergo the frontpage claim is false.

I disagree with the segfaults bit (which is what you had been focusing on so far, and which is what I've been arguing against) but yeah, "guarantees thread safety" is iffy.

The wikipedia definition is pretty vague, it relies on a concept of "safe" that isn't defined there. It's acceptable to say that "data race safety" is "thread safety", though confusing. Rust's homepage does clarify what it means in the bullet points below that statement, so I wouldn't call this a lie. It may be misleading though, and this is a common misunderstanding as steve mentioned, so I submitted a PR to fix it https://github.com/rust-lang/rust-www/pull/685

Yes I think "data race freedom" when I see "thread-safety" (I despise this one term for being so vague).

In the punchline, "prevent segfaults" is framed in negative terms. If you put "provides memory safety" it will be a bit less evocative of specific pain, but will give a warm feeling.

https://github.com/rust-lang/rust-www/pull/685#issuecomment-...

Not too sure of the segfaults bit, feel free to put in your thoughts on that PR

Yes, to second Manish, I would love to find something that is accurate, succinct, and understandable. Concrete suggestions (from you or anyone else) very welcome.

My attempts so far:

Rust is a systems programming language that runs blazingly fast, guarantees memory safety and provides correct concurrency.

Rust is a systems programming language that provides uncompromised performance, convenience and security.

Rust is a systems programming language that enables unprecedented levels of performance, productivity and safety.

edit: I like (2) best

Reply on news.ycombinator.com