Hacker News Reader

Comment by pcwalton | Hacker News Reader

> Is there any protection for non-atomic ref counting in a multithreaded environment in Rust?

Of course. Rust is memory safe. The compiler will prevent you from sharing non-thread-safe reference counted objects between threads.

This is a significant advantage over C++, where the compiler offers no such protection and so the typical solution is just to use atomic reference counting (shared_ptr) everywhere.

View on HN

So are you claiming that the exact same solution is good in rust and bad in C++?

I'm not the person you are replying to but I would never use a non atomic refcounted smart pointer in C++ because the risks associated with it are just too high. In Rust however the compiler protects me from misuse.

Separately emotionally I feel different about Arc<T> because all the counting is explicit and I see it. Understanding where shared_ptr<T> in C++ counts however can be quite a challenge, even if you consider yourself proficient with C++.

I may be in the minority here, but if you are programming properly, your understanding of the code should always be good enough that this is a non-issue. If you manage to trigger a compiler error like this at all, you are most likely hacking, not developing.

Reference count problems routinely result in vulnerabilities. Google for [cve reference count].

But these vulnerabilities can only happen if reference counting is not automatic, right?

No, because of the way references in C++ work—you can take a reference to the inside of a reference counted object without manipulating the reference count.

They could also happen if you used non-thread-safe reference counting on a thread-safe object. Now this seems to be rare in practice, because non-thread-safe reference counting is unusual. If it became more prevalent, however, I could see it happening.

Should probably but I'm not a good enough developer (yet?) to guarantee that. I rather take the extra safety from the compiler.

Real programmers apparently never make mistakes.

Unofficial slogan of the C apologism task force, apparently.

No. Real developers design their data structures and algorithms carefully. When it is tine to implement them, everything should be laid out clearly enough. There are industries where this kind of process is required and it truely shows in the quality of the results.

If the vast majority of software is not made by real developers (and I think by the definitions you are espousing it is not), then I think one of the definitions is in need to change.

As beneficial to your argument as it would be for that change to be the definition of "software", I don't think that's likely.

I needed to make a distinction in the dedinition I gave. And I stand by it, even if the wording comes across as snarky. There are software engineering methods that are proven to work. They do not involve just diving in and changing the code. But I also think that there are valid reasons to not apply these rigid development practices to certain kinds of projects. For the rest, we might well get mandatory development standards forced on us to

I am well aware of the pressure on developers to get requested feature done quickly. But the vast majority of bugs that get shipped would be easily prevented by more thorough processes. All those projects writing highly reliable software demonstrate this. But the price tag has a few zeroes appended as a result.

There are software engineering methods that are proven to work.

Rust’s type system is arguably one of them.

I was talking about processes, not tools. Rust is just tool. But good software comes from thorough processes.

Good software comes from processes that aren't afraid to adopt tools to automatically enforce those processes in order to guard against human oversight.

Tools come from processes. You need to know what the tool needs to do (the process) before you can write it.

Type systems are applied mathematics. You can’t get more engineering-y than that.

See my reply to the other comment.

Type systems are tools that simply the process of checking that you do not mangle data by applying the wrong instructions to them. They didn't come out of nowhere.

Math is a tool, too, yet applying mathematical methods is one of the defining characteristics of engineering.

> There are industries where this kind of process is required and it truely shows in the quality of the results.

It also shows in the cost of building the software. Most software companies aren't willing to pay the cost of that process. Like it or not, you will almost certainly interact with software written by these companies, either directly or indirectly.

I mean, that's great in theory, but we've been trying the "just design the program better" approach for 40 years and have been failing.

This sort of mistake gets harder and harder to prevent as programs get larger. For example, one programmer might use a non-atomic Rc pointer to hold a string in some random Error value. Later, another programmer might try to parallelize that part of the program, without realizing that sending an Error across a thread boundary is now illegal. Or maybe the same mistake happens in the other order.

Here's Niko Mastakis talking about a case where that happened to him (I think): https://youtu.be/lO1z-7cuRYI?t=4m

I don't trust myself to not make mistakes though even when I have a thorough understanding of what I'm making.

"... trusting the programmer is fundamentally wrong, no matter the programming language"

I'm not pcwalton, but he is correct. The Rust compiler only allows objects that implement the Sync trait to cross thread boundaries. Rc<T> is not Sync, while Arc<T> is. Sync is a marker trait, with impls automatically generated by the compiler for types that are comprised entirely of Sync types, or manually (and unsafely) specified by the author. As a result, Rc<T> cannot be misused from multiple threads without unsafe.

To learn more about this, look here: https://doc.rust-lang.org/beta/nomicon/send-and-sync.html

Reply on news.ycombinator.com