[PreInternet01]

Well, the general 'Rewrite All in Rust' consensus is that it solves all general programming problems, ever.

Yet, the linked repository shows a huge list of cases in which simple, documented use of Rust can cause Undefined Behavior (a.k.a. 'UB')

Pretty much every argument of Rust advocates against C/C++ boils down to either 'but memory safety' or 'but UB'.

Yet there are many convincing counter-arguments that boil down to 'but CompCert' or similar, and, as the linked repository shows, there might be at least some truth in there?

[steveklabnik]

No serious person claims that Rust solves every problem ever.

Also, many people cite things like Cargo as a reason to prefer Rust over C and C++, as well as other things. UB is a big part of it, of course, but it isn’t the only thing.

[galangalalgol]

I selected it for performance reasons myself, the UB protection was a nice benefit that was expected, cargo wasn't expected and is extremely nice coming from the cmake,conan,vcpkg and duct tape world I came from.

[PreInternet01]

> No serious person claims that Rust solves every problem ever

No, but there are a lot of people claiming that Rust cannot ever have any problems.

Just look at this thread. I merely linked to MIRI, and am currently at, like, -10 just for that.

Lots of people claiming that it just applies to 'unsafe Rust': is that true or not?

Regardless of anything else: can you, as a Rust community leader, please state clearly: is UB in generally safe Rust possible or not?

[steveklabnik]

No, people are not claiming Rust cannot have any problems.

UB is not possible in safe Rust, by design. The root cause of UB is always in unsafe code. Miri is useless if your code is 100% safe Rust.

The only exception to this is bugs in the compiler, of which there are a few. They’ll be fixed.

[chiggsy]

I have no faith in this statement. Let's see how it plays out.

[steveklabnik]

If you ever find UB in purely safe Rust, it is a very serious bug. Please report it.

[PreInternet01]

> UB is not possible in safe Rust, by design

You're available as an expert witness to that fact?

Because, eh, well, in at least one of the Rust-related situations that I'm involved in right now, someone might soon very well require the services of a person both as wise and reluctant-to-offer-any-kind-of-compromise as yourself...

[jcranmer]

The situation you've alluded to in another thread seems to involve an unsafe block (since it's using a type which is only usable in an unsafe block).

Let me be even more explicit than steveklabnik here. If your code, including any libraries you link to, is 100% Rust and free of any unsafe blocks, then (barring compiler bugs) it is impossible to execute undefined behavior. If your code has an unsafe block, then it is possible execute undefined behavior. Note that it is possible for safe code to execute undefined behavior, IF there was an unsafe block that did an operation that requires the programmer to promise something was true that was not true.

For example, there is an unsafe method that will let you convert a pointer to a reference with an arbitrary lifetime. If you wrap that in a safe function, you can return a reference to an object whose lifetime has ended, and cause undefined behavior in attempting to use that lifetime--the attempt can even be outside the safe block. But were that unsafe block that upgraded the lifetime not present, then you couldn't cause the later undefined behavior to happen.

In short, an unsafe block is where the compiler can no longer guarantee that the conditions that prevent the ability to observe undefined behavior are present, and it is up to the programmer to ensure that these conditions are met, and even and especially ensure that they continue to be met after the unsafe block completes. I do worry that too many programmers are blasé about the last bit, and it sounds like your coworker may fall into that category. But Rust has always maintained this principle.

[steveklabnik]

Yes, it is a core design tenet of the language. It's as benign a statement as "C# has garbage collection." That's not "reluctant to offer compromise."

[PreInternet01]

OK, you truly seem not to understand how much damage you're dealing to the general population using absolutist statements like this, do you? Nor do you seem to understand "compromise", like at all, because you seem to equate it with "tit for that", which is unsurprising, but still... disappointing.

In any case, I'm truly done here, in all senses of the word, but I still I wish you and your acolytes the absolute best.

[Slyfox33]

What are you talking about? Yes it's impossible to have UB in safe rust unless theres some obscure compiler bug or something. This isn't a controversial statement.

[superb_dev]

> Well, the general 'Rewrite All in Rust' consensus is that it solves all general programming problems, ever.

No, that’s not the consensus. This is a strawman.

[leftyspook]

> Well, the general 'Rewrite All in Rust' consensus is that it solves all general programming problems, ever.

a) There is no such consensus. The actual consensus is that even if Rust solved all problems, it would not be financially feasible to rewrite pretty much any substantial project.

b) While Rust does solve many problems, it is nowhere close to solving all safety, otherwise there would be no `unsafe` keyword. Alas, fully proving safety in an impure, turing-complete language is mathematically impossible.

c) The only reason you would think that there's some sort of woke Rust lobby, is if you spend way too much time subjecting yourself to opinions of literal sixteen year olds on twitter.

[timeon]

> Well, the general 'Rewrite All in Rust' consensus is that it solves all general programming problems, ever.

This is obvious example of strawman. Why are you doing this?

[PreInternet01]

Towards general mental health. I'm just a C# wage slave, and I'll admit, when being prompted, that my language, its vendor, its runtime environment, and its general approach are, to put it kindly, flawed.

However, as evidenced by the arguments and voting in this thread, Rust proponents will take no criticism, whatsoever.

I linked to a GitHub repository that documents many, many instances in which generally safe Rust causes UB.

The same kind of UB that recently hit one of my coworkers, caused a 3-day outage and now (despite all my counseling to the contrary!) will burn them out permanently.

My only request: can you guys please back off just a little bit? Programming is already hard enough without the purity wars you're stoking all the time...

[keybored]

Stoking language flame wars based on hysterical exaggeration has never promoted mental health.

[fargle]

to be fair, from his perspective, it's often the rusty crowd who is stoking the flame wars - this sounds like a reaction to them.

how often do we hear something like "C and C++ are horribly flawed and completely unsafe. it's basically a crime against humankind and gross negligence to use them"?

i get weary of that kind of thing too. i wouldn't approach it by reacting in the same way as the GP comment, but i get it. and it's not really that much of a strawman. it's more exasperation and sarcasm.

personally, i'm very interested in rust. but everytime someone at best "overhypes" it or at worse, outright dogs on other languages, it's a negative point toward dealing with the whole rust ecosystem.

[jamincan]

In all honesty, I don't see that sort of thing posted except maybe the overly naive excited "omg I love rust" post in /r/rust from someone just learning it which no one should be taking as credible.

I do, however, see people trot out the oft-repeated "rust evangelists want to rewrite everything in rust" or "rust people say programming C++ is a crime against humanity", but it seems to me that's the only place I see this argument. In other words, it's a simple strawman.

[keybored]

I don’t buy it.

People can, in the most neutral way possible, point out facts about how safe or unsafe Rust is compared to C and C++. People will STILL complain about how the Rust zealots are bullying their language. This is how it plays out every time.

You can look at this thread. The “exasperation and sarcasm“ is stupid and one-sided. “But” they always say “that’s just a reaction to a previous debate”–because the Rust zealots are always in the rear-view mirror, never in front of them.

How about complaining about something in Rust… that is bad? Like how un-ergonomic Async is? Or how pointy and awkward the syntax can be? Instead they choose to fight the losing battle over how C and Rust are equally unsafe or how actually Rust’s safety doesn’t matter, depending on the phase of the moon. Then they whine about tone and zealotry when they realize arguing against Rust safety from the C and C++ side is a losing battle and they have run out of arguments.