Hacker News Reader

Comment by erik_seaberg | Hacker News Reader

This lays groundwork for opt-in safety per file, but safety should affect API design. Once you get done doing this to every file and refactoring every public API, have you really spent less effort than would have gone into a rewrite? If you only get halfway there, is the new version going to blow up any less often?

View on HN

Depends if the goal is to improve the safety of existing C++ code, or fully rewrite into something else.

Until the likes of LLVM, GCC, CUDA, V8 and co get rewritten into something else, improving existing C++ codebases is still an issue.

I agree that safety should affect API design, which means that there is at least one major piece missing after the rewrite. Either the ability to switch to an even stricter type system (e.g. Rust) or a ~zero cost binding generator to a stricter language (again, e.g. Rust).

However, before reaching that point, piecewise refactoring is something of considerable value. There are huge C++ codebases lying around that I believe would benefit immensely from a rewrite in a safer language, even if it's not as safe as Rust (or Scala, or F#, etc.)

Firefox and Chromium have already paid the entry price for piecewise refactoring into Rust, so they're probably not the best candidates. But there are many other examples that undoubtedly are, e.g. LLVM.

Scala and F# are safer than Rust since they're on a VM.

Well, you can compile Rust to WASM. But yes, point taken, out of the box, Scala and F# have a safer execution mode.

As far as I understand, both these languages are subject to data races whereas (safe) Rust is not.

Now, Scala is a JVM language and so presumably you get Java's rules, you aren't Sequentially Consistent but the damage is constrained - however human programmers still can't successfully reason about this state in non-trivial programs.

There are plenty of other races that Rust doesn't provide any help, and those are much more relevant in distributed computing workloads.

>> Scala and F# are safer than Rust since they're on a VM.

Do you have any evidence to back up your claim?

Both the JVM (Scala's VM) and the CLR (F#'s VM) have a history of vulnerabilities:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=java+hotspo...

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=dotnet+clr

Programming languages running on VM is not a safety guarantee.

Well, it is the same 30% that Rust also cannot help much.

In the relevant sense of safety, they are safer. The commenter's claim was not about vulnerabilities, since those apply to implementations, not to languages.

The semantics of F#/Scala are memory safe because they're defined to be dynamic. The semantics of Rust are not memory safe. A subset of Rust is provably memory safe, but none that uses eg. much of the standard library which is unprovably memory safe against the lang's own semantics.

It seems weird to treat stuff that Scala must rely on but you can't write in Scala as part of the implementation, and yet not do the same for stuff Safe Rust has to rely on from Unsafe Rust.

Breaking down the full argument is very subtle, sure.

But, at the outset, we can simply observe that the "safety" Rust provides is memory safety, which is a non-issue in a dynamic language.

To say that Rust is as safe, or more safe, than a dynamic lang is false. It's strictly less safe, since by construction, it is a language where allocation is managed by the programmer.

The whole argument about "saftey" in the sense Rust addresses is between languages of "manual allocation". To imagine that any of these language is "safer", is to have misunderstood a great deal. Rust is about enabling an otherwise C-programmer to limit the impact of manual memory handling, it is *not* to prevent eg,. use-after-free errors in javascript. Since there are no such errors by construction.

The same "by construction" safety applies to Safe Rust as to the dynamic GC'd languages you're discussing. You can't write a use-after-free error in Safe Rust, the same way you can't write one in Javascript.

But, Safe Rust also chooses to construct safety that those GC'd languages don't have.

The reason Javascript doesn't have data races for example is that it doesn't have concurrency - can't have a race with only one runner. Java does have data races (with limited but still unsettling consequences), Go's data races are really bad, like actual Undefined Behaviour bad in some cases. Whereas Safe Rust doesn't have data races - you can write concurrent Safe Rust but you can't write a data race.

The difference you're grappling for probably feels intuitively like it should exist, but I assure you it does not.

You are right that the argument boils down to what we take "by construction" to mean.

I will resolve this, simply, by saying whatever advertisement Rust makes for itself, is better made by any "dynamic" language.

And if we're inclined to trade PR against PR, Rust looses. Managed memory has better PR.

And so those repeating the Rust agitprop against managed languages are simply "NPCs for the wrong ideology".

I would articulate things differently.

Theoretically, memory-safety between Rust and managed languages is equivalent.

However, memory-safe languages (i.e. not Managed C++) running on a memory-safe VM have one more layer of defense in depth than Rust. This matters in case there is a bug in the compiler or any of the dependencies. Additional layers may include, for instance, Unix and containers.

"dynamic" languages, though? That's entirely orthogonal to memory-safety and not very good for general software safety.

Given that F# has unmanaged pointers (nativeptr), wouldn't it also be true that only a subset of it is provably memory safe, just like Rust?

C++ templates cannot be reused or rewritten piecemeal in a new language, it's practically impossible. There's a reason why the Rust folks were very careful to separate out generics from the more flexible case of macros (that come in both rewrite-based and procedural varieties).

Out of the box, they can't, but I can imagine mitigations for that, if you have robust enough static analysis on your new language. For many cases, it's fairly trivial to generate a piece of .cpp that simply instantiates a template for a specific type and can be linked against.

Of course:

- this doesn't cross library boundaries;

- this assumes robust enough static analysis, which is not possible in the general case, since templates are non-decidable in the general case – so you need to restrict your new language to more reasonable semantics;

- let's not even get started on the interaction between templates and C-style macros – at some point, you need to throw the towel.

Your first question ignores the crux of the matter: from scratch rewrites of software that is actually worth rewriting are always failures in the making. While the rewrite is ongoing, the original must undergo continued maintenance and this (a) doubles the workload of the team and (b) presents an ever moving target for the rewrite. This means that the effort that goes into piecemeal improvement is the minimal effort possible that can succeed.

Successful piecemeal rewrites will result in gradual improvement, so if you don't see that gradual improvement over time, something is very wrong with the project.

Kotlin managed it in some cases with clever forwards compatible type system tricks, so it's not impossible

Except it does so by compiling into the same bytecode as Java, javap will just output Java like code from class files, and some stuff like co-routines cannot be called from existing Java code without wrappers that setup the runtime semantics as expected by Kotlin libraries.

Yes, but so? When they can implement a feature in a forwards compatible way they do, when they can't, they don't and it's caveated as such. That's why nullable types and other Kotlin specific type stuff are encoded using annotations.

It's the same strategy here. Carbon is (was?) also intended to compile to the C++ ABI and so does Circle, that's why it says it doesn't run on Windows (commercially a huge error. many of the biggest C++ codebases that could benefit are running on Windows like game engines, and Windows doesn't impose a specific C++ ABI anyway). But there's no way to take existing code files and switch them to the new language in Carbon, at least not yet. Kotlin was carefully designed at every step of the way such that every Java program can be expressed in Kotlin without change, even if that meant compromising on some things. Seems like the Carbon guys are being sucked up by the lure of safetyism and just want to make their own version of Rust that happens to compile to the Itanium C++ ABI.

It is only forward compatible, is stuck in decisions when Java 8 was current, there is no roadmap to keep the language in sync wiht the underlying progress of the platform as Kotlin tries to be everywhere.

Loom, value types, SIMD, Panama,... are all features that start to be an issue to expose as Kotlin features.

It is working on Android, because Google is pushing it as Java 8 => Kotlin, not as Java XYZ <=> Kotlin.

Loom doesn't need to pose any issues for Kotlin. If you target only the JVM, you just use virtual threads directly and ignore the coroutines stuff. If you target other runtimes you use them. If you use a KMP library, just surround stuff marked async with runBlocking {}.

SIMD/Panama stuff is just new APIs. No problem there. Kotlin maybe even wins because Panama is super verbose.

JVM value types seems never to arrive. Stuck in dev hell for years maybe. If/when it ever does see the light of day, Kotlin has value types and so it can just be compiled to a JVM value type to get the benefits. You'd need to opt in to an ABI break but no big deal.

So the binary compatibility part hardly seems an issue even looking forward a long way into the future.

It's probably harder for C++ because the language there seems to evolve quicker than Java!

What Kotlin calls value types aren't the real deal, just syntax sugar for primitive types with method with a single field.

KMP taken to the extreme, is better for Kotlin just to do its own thing with Kotlin/Native, except it is so behind that JetBrains is using Rust instead for Fleet services.

Java is expected to have language level support for some of those features, will Kotlin catch up?

I'd like to target Windows. Windows does impose a specific C++ ABI, but it's completely undocumented. It's really just whatever Visual C++ does. C++ ABI is very complex, especially vtable layout and RTTI and EH. I am looking to get Microsoft's assistance on targeting Windows. It's a priority, but they don't want to help yet.

Isn't that what com is for? Win32 is compiler agnostic.

https://itanium-cxx-abi.github.io/cxx-abi/abi.html See all the stuff there? exceptions, vtable layout, rtti, mangling, etc. There's a Windows equivalent for all of that. That's what I want access to.

Right I know what a C++ ABI is but I still don't get it. To write C++ apps on Linux you need to match the ABI because there are lots of raw libraries that are just straight compiled C++. On Windows it's not like that outside of the VC++ runtime itself. Everything is C APIs or COM, and wrappers around that. MS never documented their C++ ABI because as far as they're concerned it's not something anyone needs to know, in order to write Windows apps or have components/libraries interop with each other. They never expose raw C++ objects in Windows. When they have C++ APIs they come as source or headers.

Reply on news.ycombinator.com