Rust

6009 readers

5 users here now

Welcome to the Rust community! This is a place to discuss about the Rust programming language.

Wormhole

[email protected]

Credits

The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)

founded 1 year ago

MODERATORS

Rust needs an official specification (tweedegolf.nl)

submitted 6 days ago by snaggen to c/rust

21 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] FizzyOrange 10 points 6 days ago (1 children)

you can say that without a spec as well but what does “wrong” mean then? It just means you personally disagree with its behavior.

Nope. Specs can have bugs. Here are the bugs in the C++ spec for example:

https://www.open-std.org/jtc1/sc22/wg21/docs/cwg_toc.html

As I said, specifications are useful and desirable, but the SIL's dogmatic "no spec = unsafe" is clearly not based in reality.

[–] [email protected] 5 points 5 days ago (1 children)

In SIL world, the C++ issues would not be considered bugs but maybe change requests.

The SIL philosophy (as far as I know it from ASIL) is "unsafe unless convinced otherwise". That seems like a good idea when the lifes of humans are on the line. Without a spec how would you argue that a system/product is safe?

(Aside: Software in itself cannot be safe or unsafe because without hardware it cannot do anything. Safety must be assessed holistically including hardware and humans.)

[–] FizzyOrange 8 points 4 days ago* (last edited 4 days ago) (1 children)

would not be considered bugs but maybe change requests.

That's just playing with semantics. They are clearly bugs. They are literally called "defect reports".

Without a spec how would you argue that a system/product is safe?

Lots of testing, including randomised testing and ideally formal verification.
Comprehensive test coverage - both code coverage (lines, branches) and functional coverage (hand written properties).
Functional safety features (ECC, redundancy, error reporting & recovery, etc.)
Engineering practices known to reduce the chance of bugs (strong static types, version control, CI & nightly tests, rigorous engineering processes - requirement tracking and so on, and yes ideally well written specifications for all the tools you are using).

There are many aspects to safety and it's definitely a good idea to have a spec for a language, but it doesn't automatically mean safety is impossible without it.

Software in itself cannot be safe or unsafe because without hardware it cannot do anything.

The nice thing about abstraction is that you can talk about software without considering the hardware, more or less. If one says "this software is safe", it means it's safe assuming it's running on working hardware.

It doesn't always hold up - sometimes the abstraction leaks, e.g. for things like spectre and rowhammer. And there are sometimes performance concerns. But it's pretty good.

[–] [email protected] 4 points 4 days ago

You definitely can do without a language spec. I heard in aerospace another approach is common: They use whatever compiler and then verify the binary. That means different tradeoffs of course.