507
One Of The Rust Linux Kernel Maintainers Steps Down - Cites "Nontechnical Nonsense"
(www.phoronix.com)
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
They're being downvoted because it's a silly comment that is basically unrelated and also extremely unhelpful. Everyone can agree that C has footguns and isn't memory safe, but writing a kernel isn't memory safe. A kernel written in Rust will have tons of unsafe, just look at Redox: https://github.com/search?q=repo%3Aredox-os%2Fkernel%20unsafe&type=code That doesn't mean it isn't safer, even in kernel space, but the issues with introducing Rust into the kernel, which is already written in C and a massive project, are more nuanced than "C bad". The religious "C bad" and "C good" arguments are kinda exactly the issue on display in the OP.
I say this as someone who writes mostly Rust instead of C and is in favor of Rust in the kernel.
The difference is that now you have a scope of where the memory unsafe code might be(unsafe keyword) and you look there instead of all the C code.
I agree and think that should be helpful, but I hesitate to say how much easier that actually makes writing sound unsafe code. I'd think most experienced C developers also implicitly know when they're doing unsafe things, with or without an
unsafe
block in the language -- although I think the explicitunsafe
should likely help code reviewers and tired developers.It is possible to write highly unsafe code in Rust while each individual
unsafe
block appears sound. As a simple example: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=6a1428d9cae5b9343b464709573648b4 [1] Run that onDebug
andRelease
builds. Notice the output is different? Don't take that example as some sort of difficult case, you wouldn't write this code, but the concepts in it are a bit worrisome. That code is a silly example, but each individualunsafe
block appears sound when trying to reason only within the block. There is unsafe behavior happening outside of theunsafe
blocks (thedo_some_things
function should raise eyebrows), and the function we ultimately end up in has no idea something unsafe has happened.Unsafe code in Rust is not easy, and to some extent it breaks abstractions (maybe pointers in general break abstractions to some extent?).
noaliases
in that playground code rightly assumes you can't have a&ref
and&mut ref
to the same thing, that's undefined behavior in Rust. Yet to understand the cause of that bug you have to look at all function calls on the way, just as you would have to in C, and one of the biggest issues in the code exists outside of anunsafe
block.[1]: If you don't want to click that link or it breaks, here is the code: