I agree and think that should be helpful, but I hesitate to say how much easier that actually makes writing sound unsafe code. I’d think most experienced C developers also implicitly know when they’re doing unsafe things, with or without an unsafe block in the language – although I think the explicit unsafe should likely help code reviewers and tired developers.

It is possible to write highly unsafe code in Rust while each individual unsafe block appears sound. As a simple example: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=6a1428d9cae5b9343b464709573648b4 [1] Run that on Debug and Release builds. Notice the output is different? Don’t take that example as some sort of difficult case, you wouldn’t write this code, but the concepts in it are a bit worrisome. That code is a silly example, but each individual unsafe block appears sound when trying to reason only within the block. There is unsafe behavior happening outside of the unsafe blocks (the do_some_things function should raise eyebrows), and the function we ultimately end up in has no idea something unsafe has happened.

Unsafe code in Rust is not easy, and to some extent it breaks abstractions (maybe pointers in general break abstractions to some extent?). noaliases in that playground code rightly assumes you can’t have a &ref and &mut ref to the same thing, that’s undefined behavior in Rust. Yet to understand the cause of that bug you have to look at all function calls on the way, just as you would have to in C, and one of the biggest issues in the code exists outside of an unsafe block.

[1]: If you don’t want to click that link or it breaks, here is the code:

fn uhoh() {
    let val = 9;
    let val_ptr: *const usize = &val;
    do_some_things(val_ptr);
    println!("{}", val);
}

fn do_some_things(val: *const usize) {
    let valref = unsafe { val.as_ref().unwrap() };
    let mut_ptr: *mut usize = val as *mut usize;
    do_some_other_things(mut_ptr, valref);
}

fn do_some_other_things(val: *mut usize, normalref: &usize) {
    let mutref = unsafe { val.as_mut().unwrap() };
    noaliases(normalref, mutref);
}

fn noaliases(input: &usize, output: &mut usize) {
    if *input < 10 {
        *output = 15;
    }
    if *input > 10 {
        *output = 5;
    }
}

fn main() {
    uhoh();
}

the kernel continues to get inundated with memory safety bugs that no amount of infrastructure, testing, code review, etc is catching.

I’d say this is the issue to fix. It’s not easy but if anything curl has proven it can be done efficiently.

It’s not just about bad/good C programmers. It’s also about how much of the context, the given C programmer has read to make sure they know enough of what they are doing.

No matter how good one is at Programming, they need to make sure to read and remember what is happening in relevant parts of code, while making their one off contribution.

That’s where the part of “leaving it to the computer” comes in. Hence, the usefulness of code checkers and even better if the compiler itself enforces the stuff. As long as the rules are good enough.

Let’s just hope we are not jumping to another language 20 years down the line.

Anti Commercial-AI license

Part of the hostility was the other maintainer misunderstanding the presenter, going on a diatribe about how the kernel Rust maintainers are going to force the C code to become unrefactorable and stagnate, and rudely interrupting the presenter with another tangent whenever he (the presenter) tried to clarify anything.

An unpleasant mix of DM railroading and gish galloping, essentially.

I wouldn’t quite call it a strawman, but the guy was clearly not engaging in good faith. He made up hypothetical scenarios that nobody asked about, and then denigrated Rust by attacking the scenarios he came up with.

Edit: I was thinking of the wrong fallacy. It is a strawman, yes.

Figure 2: https://sci-hub.se/https://link.springer.com/article/10.1007/s11416-021-00379-x