[rvz]

The actual reason:

> In conclusion. Too early, lack of experts, rapid evolution pains. It was stacking risk on top of an already risky project.

Rust was extremely immature and too early to be used in an OS at the time. It just hit 1.0. By then, Fuchsia already wrote its kernel Magenta (now Zircon) in C++.

In short, it did not make sense to write the OS kernel in Rust from both a technical and business standpoint at the time.

[fulafel]

Rust is not the only game in town though, there are the traditional estabilished safer alternatives to C++.

[chakkepolja]

Dude it's a kernel. What other alternatives do you suggest? ATS and all sound nice for academic projects but it's an industry project (even if some research purpose is there) they have different tradeoffs.

[the_why_of_y]

Ada has been around since the 1980s and works in this space; see for example Muen separation kernel: https://muen.sk/

[chakkepolja]

Ada is not even as popular as rust. Betting on Ada is not viable for Google.

[pjmlp]

NVidia thinks otherwise,

https://www.adacore.com/company/partners/nvidia

[aaron-santos]

I'm curious what you think the risk management strategies are for NVidia and Google projects and why they are the same.

[fulafel]

I'm sure they don't need my recommendation, and the whole thing is moot today if Rust has fixed the issues in the years since.

But to play with counterfactual history: Apparently Go is fairly big there. There was a Usenix paper about a Go kernel a while back, and there's also gVisor. Then there is Ada, and Kotlin native, and various safe dialects of C. MS did one in .NET - there were lots of options.

[staticassertion]

There are papers with Python kernels. Doesn't mean Python's a good language for writing a kernel. gVisor had to fight Go quite a lot, I think it was a huge mistake for them to choose it.

Ada is the only language you've mentioned that really fits IMO. One of the safe languages like P would be interesting but it's unproven in the space.

As for Ada, it's a sad story, but ultimately the language is unlikely to gain traction after too many early mistakes (particularly around licensing).

[fulafel]

Of course I now had to go dig up the reference due to the flippant Python kernel comparison :)

The benefits and costs of writing a POSIX kernel in a high-level language

Cody Cutler, M. Frans Kaashoek, Robert T. Morris MIT CSAIL

https://www.usenix.org/conference/osdi18/presentation/cutler

So its from quite a prestigious institution, has at least one big authors, and concludes that it works quite well and recommends it over C for new kernels and VMMs.

I also disagree the "no traction" argument about Ada since it's been used in real projects and had a big enough developer community for a long time, and is alive and well. People can surely pick up new programming languages when they join a new project, I know I've done it many times. Tooling licensing should be fine as well since GNAT is available under GPL + Licensing exception, same as Google has been using with GCC since dawn of time, and under the Adacore license which Google probably can afford.

So, I hold that there were many other options vs Rust. Including the others in my original comment that we didn't get to in details. Except Kotlin Native, I made a timeline mistake there, it was too early in 2016.

[pjmlp]

Several 80's kernels had enough Mesa, Modula-2 and Object Pascal on them.