Hacker News Reader

Comment by youdontknowtho | Hacker News Reader

So rust isn't memory safe? You can still access invalid pointers?

I'm just trying to clarify...it's lifetime safe, but not access safe, or leak safe?

You have two dialects: Safe Rust and Unsafe Rust. Safe Rust is regular Rust code, the kind of code that you should write 99.9% of the time. Unsafe Rust is a superset of Safe Rust; all of the Safe Rust checks still apply. Within an unsafe block, you gain access to a few extra tools that are not available in Safe Rust: you can dereference raw pointers, you can modify global variables, you can invoke unsafe functions, and a few more.

Unsafe code allows programmers to write code the compiler can’t check. Unsafe code is expected to uphold the safety invariants, but humans can make mistakes.

Most people mean “safe Rust” when they say “Rust.”

Leaks are memory safe though. They’re hard, but not impossible, to get.

> Most people mean “safe Rust” when they say “Rust.”

I disagree. I think they mean Rust code they see in use that has no explicit "unsafe" blocks. For example, most people are going to say "let mut v = Vec::<i32>::new(); v.push(0)" is "safe Rust." It is, in the sense that all the rules of Rust safety apply to the specific code quoted as-is. It also isn't, because 'Vec' is littered with unsafe.

If you're wearing x-ray glasses to look at the implementation details, no language is safe (e.g. CPython's vectors/lists are written in C). It isn't a useful contention.

That’s what I mean by “safe Rust”, so we agree.

We don't, though. The quoted code isn't safe. It has implicit unsafe blocks in it. You can't claim there are two dialects of Rust if you inlcude the "unsafe" dialect in your definition of "safe" as long as there isn't an explicit "unsafe" block present. It's misleading

That's not a useful definition, though, as that means that all code everywhere is unsafe, since the hardware is.

Although you can access invalid pointers, there are plenty of ergonomic ways not to.

If Rust never let you write code that could "go wrong", then it would not be useful for its target domain. Sometimes you need a "trust me" block where you call some internal allocator or trusted library function. It's more about the balance of affordances: is it easy to do the right thing in Rust, whereas in C it is easy to do whatever.

Reply on news.ycombinator.com