today at 12:51 PM
It's surprising this bug went unnoticed for so long, but at least it's easy to fix, since it's not a bug with the type system itself; it's just a bug in the compiler. The compiler should always have been rejecting that code according to lifetime rules of Rust's type system, so the fix is to just make it reject the code, rather than having to change the fundamental rules of lifetimes.
today at 1:17 PM
It's fascinating that this kind of bug is exactly you can't really avoid even when rust is supposedly to guard against. Rust mitigated this problem a lot in practice, but you can never be certain because of issues like this in practice. This is similar that a math proof that's already been peer reviewed and accepted as truth, may still be possible to be wrong, although the chance is very small but it's not zero. Epseicially when the complexity gets higher.
today at 9:20 PM
In theory it would be possible to formally verify the soundness of the borrow checker. Maybe with AI advances we'll be able to do that in the near future. I mean, how much more complicated can it really be than proving Navier-Stokes?
today at 10:05 PM
Note that the Lean kernel itself is not formally verified.
today at 9:27 PM
You can't formally verify the soundness of something that inherently necessarily relies on hardware implementations that themselves could be faulty.
today at 9:50 PM
You take hardware properties as axioms (for instance, ARMv6 cache coherency is specified in detail as part of the lengthy spec, even though you have no guarantees that the hardware actually is faithful to the spec)
today at 9:39 PM
You can certainly verify the soundness of what is within your control, the compiler code, which is what is being suggested above.
today at 9:40 PM
You can formally verify that the algorithm has the desired properties, though. If the hardware requires additional properties for soundness, then that would only be an error in the properties, not in the proof. (Of course, that would no longer prove soundness on that hardware.)
today at 8:37 PM
How is this different from any other compiler bug?
There was one in the Linux kernel a while ago that mistakenly eliminated an important null check.
Is this different?
today at 9:39 PM
No, people who don't actually use Rust just like to pretend it's something more than it is, for some performative outrage or something.
Here's the current list of similar (unsoundness-causing) open compiler bugs in Rust:
https://github.com/rust-lang/rust/issues?q=state%3Aopen%20la...
today at 2:55 PM
... and even if you formalize it, it could still be false due to an error in the theorem prover itself.
today at 3:24 PM
And even if the theorem prover has no errors, the math behind the theorem prover could be inconsistent according to Gödel's incompleteness theorem. So even in principle, we can never be completely certain about the soundness of Rust, though the more theoretical concerns tend to be dwarfed by basic human error.
I think it's a good thing to keep in mind, that the actual implementation of Rust almost certainly isn't sound. Even an "ideal Rust" still has unsafe, which can affect the soundness of even faraway safe code. But I don't think it's nessesarily wrong to talk about Rust as if it were safe. Much of our communication has implicit assumptions, and the way we talk about Rust is no different. It would be exhausting to qualify every discussion of saftey with "assuming the compiler has no bugs", "assuming all unsafe code follows the (not fully specified!) rules", etc.
Ultimately it's like any other implementation of theory into practice. The theoretical model of Rust lets us reason about and design an implementation to achieve certain practical goals even though the model is a simplification of reality. In Rust's case, practical use has demonstrated it achieves design goals like reducing bugs and reducing development time (compared to peers like C++) to a substantial degree.
today at 6:56 PM
It’s like Python describing itself as fast. Everyone knows that means “fast enough for intended use”, not “fast in an absolute sense”. But for some reason when Rust describes itself as safe people take that to mean in an absolute sense.
today at 9:07 PM
Rust scores a lot higher on the safe scale than Python scores on the fast scale. Also, who are these mythical people that call Python fast?
today at 10:16 PM
Python calls itself fast in its own webpage, pretty predominantly:
Python is powerful... and fast; plays well with others; runs everywhere; is friendly & easy to learn; is Open.today at 6:41 PM
Or more likely, an error in the formalization. "What you proved is true, but it's not sufficient for what you care about." See for example WPA2 KRACK attacks after WPA2 was proven secure.
today at 1:02 PM
Not knowing anything about rust, the problem in these type of case is making it rejecting that bad code without also rejecting valid programs. But maybe this is indeed easy to fix, I don't know.
today at 2:06 PM
In this case the issue is that the compiler just isn't properly type checking the implicit call to the drop method that's inserted at the end of the nested block. AFAIK, no correct code should depend on the absence of that check.
today at 1:15 PM
There are no such valid programs. Proof by contradiction:
A valid program would be exploiting undefined behavior in rust, but rust has no undefined behavior. Thus such a program must not exist.
Now a program may appear to work before the fix, but it was never a valid Rust program.
today at 1:29 PM
I can't tell if you are sarcastic, but in case you are not:
By Rice's theorem you cannot be sound and complete, i.e. accept all valid programs and reject all invalid ones. Most languages choose to be sound but not complete, i.e. reject all invalid programs but also some valid ones (C and C++ are the notable exception, although most languages have escape hatches). GP was saying that the fix might reject valid programs that compile today. This is true for some existing soundness bugs, but not necessarily for this one specifically.
today at 3:26 PM
Rice's theorem does not apply. This is not about what the compiler does, it is your program. If your program is not sound then it is invalid Rust even if the compiler accepts it and it seems to do the right thing.
That said, I was sarcastic.
today at 4:52 PM
Terminological nitpick, but soundness is a property of an entire type system not of an individual program. A type system is sound if it only accepts valid programs. A program is valid if it never exhibits undefined behavior.
Rice's theorem implies that it's impossible to precisely distinguish valid and invalid programs just by looking at their source code. Thus Rust rejects some valid programs in order to be sound (e.g. "if false { None.unwrap_unchecked() }").
In the case of the bug report in OP, I don't think that there are many valid programs in practice that exploit this soundness issue, so fixing it just means rejecting more invalid programs.
today at 3:50 PM
It does apply, of course (even if not to this case specifically). The implemented Rust semantics are not sound, as evidenced by this issue. We need to find (or adjust) sound semantics. Which, mathematically, is equivalent to designing Rust from scratch (ignoring things like RustBelt because they did not formalize the entire system). Due to Rice's theorem we know we need to give up some sound programs. Can we give up exactly the programs we already gave up for the previous Rust? Maybe, maybe not.
today at 4:55 PM
The tricky thing about formalization is that you usually have to reimplement the type checker into a proof assistant in order to do formal soundness proofs. It's not necessarily clear that this reimplementation is identical to the actual Rust compiler (in fact, you often have to massively simplify the type system to make the proofs tractable), so bugs in implementation can cause unsoundness without being related to fundamental flaws in the soundness of the type system.
today at 5:12 PM
Indeed. Proving the implementation will likely never be done, it's just way too hard. But proving Rust abstract semantics are sound will by itself be a major leap forward (RustBelt did that for a subset of Rust).
today at 4:54 PM
> The implemented Rust semantics are not sound, as evidenced by this issue. We need to find (or adjust) sound semantics.
You’re ignoring the possibility that Rust semantics are sound, and the implementation doesn’t fully implement them. In that case, we do not have to find sound semantics.
That, I think, by far is the most likely option.
Reason: I’ve not seen a single comment claiming the example should compile, and zillions (implicitly) acknowledging this is not what Rust should do.
today at 5:10 PM
I explicitly did not ignore the option that there are possible sound semantics:
> but not necessarily for this one specifically
> Maybe, maybe not.
But "the Rust semantics" are not defined, formally. The closest we have is what Rust implements currently, and that was shown here to not be sound. Other than that, we maybe have vague ideas in the brains of some T-types members, which are not detailed enough to determine soundness (source: those type system people want to formalize the semantics so they will be).
And for the record, we know of other soundness issues where the likely resolution path will involve rejecting valid programs we accept now, and the only question is how many.
today at 4:55 PM
It could be that I'm totally yapping bullshit, but the "designing from scratch" can vary depending which field of maths you're talking about. For instance, if we model the semantics as a series of composable functions, then you only have to scratch only the specific dependency tree of the functions. Basically everything can be reused with no wasted work, and the output space gets culled.
today at 5:11 PM
Which is why I said to ignore RustBelt. Because we don't have formal semantics today, we only have the actual implementation which is not composable.
today at 3:33 PM
Rust does not target Turing machines so Rice's theorem does not apply.
today at 7:21 PM
Rust does have undefined behavior, though.
today at 12:16 PM
This is remarkable but not super unusual. There are more than 100 issues labeled unsound currently. Some are long standing but from what I understand the new trait solver will unblock fixes for some of them (but probably not the one in OP).
today at 12:48 PM
Finding unsoundness bugs isn't the most unusual, yes. But this one is unusual in how simple the code that causes it can be (see the versions of the reproducer code in the comments). For other unsoundness bugs, the code would need to contort itself a lot to avoid the compiler checks.
today at 10:22 PM
Writing manual Drop isn't usual. And writing drop with such lifetimes is definitely on the weirder scale.
today at 2:41 PM
today at 1:30 PM
[flagged]
today at 1:43 PM
Not really.
The idea is that safe Rust promises that you can't cause UB without unsafe.
Unfortunately there are cases, where the current rust compiler implementation fails to keep that promise. These cases are all tracked as bugs and it's expected they'll be fixed eventually. AFAIK non of the known cases is unfixable, it just takes time and effort, sometime a lot.
Also note that C++ does not make such promises in the first place, so the equivalent code there isn't a bug, it's just UB.
today at 11:54 AM
Perhaps ironically, AI-based searching of the Rust compiler for bugs is likely to find more of these, pushing Rust closer and closer to the point of complete reliability.
The eventual formalization of Rust and a creation of a formally proven compiler is presumably going to be the end point of this process.
today at 12:39 PM
Why would that be ironic? AI is helping us find so many subtle bugs and isolate the root cause, it’s nearly perfect for this type of use case.
today at 2:08 PM
> complete reliability.
I think that’s a myth! What tends to happen in mature software is there are unfixable tradeoffs that can be made that favor one use case or another. And of course people will keep adding features too
today at 3:04 PM
That’s why they said “closer”
today at 5:34 PM
Just wait until someone relies on that bug too.
today at 10:11 PM
Rust considers fix to unsoundness bug, a change that can be done at any SemVer revision (i.e. a patch version bump can break it).
If your spacebar heater relies on such behaviour Rust can and will break it. If you're in the crater group you'll be notified and urged to upgrade it.
today at 12:44 PM
What aspects of it are remotely ironic?
today at 1:11 PM
Obviously, many people have viewed AI’s contribution to programming as just producing unreliable garbage.
Yes, that’s an incomplete and tenuous belief, but that’s where the irony is. If you’re omniscient you don’t get to experience irony.
today at 12:55 PM
Hey, if Alanis Morissette can make the same mistake…
today at 3:28 PM
“Slop generator makes all future programs more reliable”
today at 4:08 PM
Yeah this is actually quite interesting. I can see how people who have this "slop generator" perspective on AI would see this as an irony. But to me, it isn't an irony, it's a demonstration of why this perspective on AI is wrong.
today at 12:02 PM
Until they find bugs in the formal proof program ;)
https://www.lesswrong.com/posts/zHhGa3iQBQcdSifFL/a-critical...
today at 4:31 PM
It is well known that proof assistants can be wrong. Fortunately, the theories underlying formal methods are usually simple enough that it is feasible to write verifiers for these proofs.
today at 7:48 PM
[dead]
today at 1:15 PM
The UB goes all the way down!
today at 12:04 PM
today at 12:55 PM
I asked myself, How many comments to do I have to collapse before someone says something about AI. 3.
I used to compare this hype to crypto hype, but its so much worse. Can we just try not to shove llms into every single conversation.
Is there a hackernews type space where the word is banned? Even lobste.rs has this problem. I need some sort or way to just hide all content on certain sites where LLMs/AI are mentioned.
today at 8:36 PM
I browse Hacker News stories via this: https://unslop.news/
today at 9:58 PM
Yeah the HN home page today seems especially bad
today at 8:44 PM
Wow interesting
today at 3:34 PM
lobste.rs has a `vibecoding` tag that you can hide.
today at 8:39 PM
Unfortunately, a large proportion of stories submitted to Lobste.rs are slopped out... even if they don't mention AI, it's hard to escape there. Hacker News at least has functioning story-level moderation.
today at 5:27 PM
I didn't realize that, thanks
today at 1:19 PM
I'm not a huge AI hype man, but I think you'll just have to accept it. It's a new useful tool, of course people are excited to apply it to everything.
Like it or not, programming will become largely LLMs. And the comment you're replying to is actually making a pretty good case for where the use of LLMs is good: generating code to be formally verified.
today at 2:16 PM
Something something halting problem. I never said don't use the tool!! I use the tool too! I just dont want to talk/read about it all the time.
Programming will never be dead.
1. Because the situation you describe is fantasy.
2. Even if it is a reality and all software can be verified (it cant), I will still be programming and so will millions of others because its fun, programming and sex are really damn close to things I cant live without. Not everyone got into engineering for the money. I legitimately love this activity, it is my actual passion. I would rather be poor than give it up.
Its like im being told everyday all day, non stop that the thing I love is not worth loving.
today at 4:40 PM
Of course people will still program for the foreseeable future. But it is still a legit question how long it will be before people come to accept a vibe coded program and are ready to deal with its flaws (of course with more vibe coding) compared to hiring a consultancy.
I'm not talking about mission critical software, but bespoke business applications that are produced by software engineering sweatshops and where the actual users are inured to incomplete features with sharp edges, arcane bugs, and incomprehensibly long intervals between bug report and fix.
Even in mission critical software we will likely see a lot of LLM tool usage. Even if the copyright plug is pulled and all vibecoded applications are regarded as copyright violations, its uses to analyze existing code and give advice will remain. In this world, writing applications entirely by hand will become an artisanal discipline.
today at 8:16 PM
I see. I'm not trying to put down your love of programming. The only programming that I really can say excites me (C64 or the like) died a long time ago, before I even started programming for money.
Nothing is stopping you from enjoying the sort of programming that you like. But I think it's healthy to accept that that style will soon not be mainstream. It will be like knitting your own clothes, and that's okay.
Regarding formal verification, it's not needed, as LLMs already make on average about as many errors as the average human programmer.
For me, 90% of programming is just a tool to get the job done. It's like a machine in a factory that spits out 50 spoons a minute, and it doesn't need to be any more beautiful than that. If you enjoy woodcarving and want to spend an hour making your own spoon, do that and don't let the existence of the machine make you feel that hobby is any less worth loving.
today at 3:07 PM
This seems more like you projecting what you want in terms of what you enjoy and hoping the world optimises around that preference.
The truth is LLMs is what you need to be optimising around as they will become the standard.
today at 3:21 PM
today at 3:17 PM
Why don't you start TruthLLM like Trump started TruthSocial?
today at 3:16 PM
You need to bow in the direction of Silicon Valley every three hours or the inquisition comes.
today at 2:22 PM
I guess that’s something you need to work through that you’re just so sick of reading about the single biggest evolution in technology since the internet :(
Maybe tech isn’t for you if you don’t like trying to stay on top of it.
today at 2:40 PM
Huh...
Anyways, I probably know more about llms than you, I probably use them more than you. I just dont want to turn every conversation into a discussion about them.
I would argue the smartphone is 1000x more impactful than LLMs, along with many other inventions since the internet. I'm not really sure what contribution llms have had that are actually THAT impactful for peoples lives. Its possibly (but unlikely) a net negative, time will tell. Most people using them are not getting smarter, thats concerning. Most are just making more money for their bosses who are itching to replace them with an llm.
today at 8:21 PM
I think the problem you're seeing is not with LLMs per se, but with capitalism. Imagine we have a quite useful machine that's reducing the amount of work needed to accomplish stuff, and all normal people are afraid of that machine simply because they worry they'll have less work. How backwards is that!
If we didn't let people live off the work of others, as the capitalists do, then we could all rejoice in that we've found yet another way of reducing the labor required to produce stuff.
Yet, in the real world, it seems as despite the progress of technology, the labor of the everyman is constant, and only the richest get more and more shiny jets and yachts.
today at 3:15 PM
Thank you for citing the Anthropic propaganda manual!
today at 12:53 PM
and what stops AI from "accidentally" writing code with such bugs?
today at 1:27 PM
Code review and testing? As always?
today at 2:44 PM
[flagged]
today at 4:45 PM
Even if you could be trusted to do that, we still need languages like Rust and tools like ASAN and Valgrind. Trust but verify. Trust alone is not enough.
today at 3:30 PM
The compiler. That’s the whole point here. Type systems can prove the absence of entire classes of bugs, at compile time. If AI identifies bugs in type systems that can be corrected, then all future programs benefit, including those written by AI.
today at 12:15 PM
Or we realize that it is not possible, and Rust accepts to be "just" a definitely safer C.
today at 12:24 PM
There is a formally proven compiler for a large subset of C, so I don't see why formalizing (a large subset of) rust and making a formally proven compiler shouldn't be possible
today at 12:56 PM
Also unlike C, it should be possible to formalize all of Rust, not just a subset. For two reasons: Rust evolution (not initially but today) is strongly tied with formalizing it and the language team consults with formalization experts (which are part of the Rust project themselves) all the time (and formalization or semi-formalization projects are ongoing), and also the mathematical understanding of system languages itself has advanced.
today at 1:46 PM
This reminds me of Hilbert’s Program .
today at 12:53 PM
There is a severe misunderstanding here. Beside being only a subset, CompCert definitely has UB. It just formalizes codegen for codebases not containing UB, which obviously won't be enough for Rust.
today at 12:30 PM
Because people want a performant optimizing compiler.
today at 6:40 PM
CompCert produces surprisingly fast native code.
This 2022 article [0] says it generates binaries that run about 7% slower than what GCC produces with -O1.
[0] https://www.cs.cornell.edu/courses/cs6120/2022sp/blog/compce...
today at 2:03 PM
I feel like these things get waved around as gotchas without any sense for whether any real code is impacted.
It will be interesting to see if fixing this bug actually causes any crates to not compile.
today at 2:11 PM
We should know shortly, the PR to fix this will presumably be paired a crater run, a build of the entire public crates universe.
today at 11:16 AM
Type systems are hard! Check out https://counterexamples.org/
I gave it a quick scan for Rust examples; there are 11 samples among the following pages:
https://counterexamples.org/eventually-nothing.html
https://counterexamples.org/mutable-matching.html
https://counterexamples.org/selfishness.html
https://counterexamples.org/scope-escape.html
https://counterexamples.org/nearly-universal.html
I wonder if TFA's example could be reproduced without mutability.
today at 4:36 PM
https://github.com/JelleZijlstra/unsoundness is also a great collection of Python type system holes. In these cases, it's mostly deliberate design decisions, not bugs. The unfortunate fact is that a fully sound Python type system would be a pain to use.
today at 7:15 PM
> The unfortunate fact is that a fully sound Python type system would be a pain to use.
Even beyond Python, most gradual type systems are unsound by design.
today at 4:49 PM
Perhaps I'm just an old dog that doesn't want to learn new tricks, but I still can't think of Python as typed and I never use type hints. I started with Python during the 2.3 era. I still view Python types as merely docs. So it's nice that someone tracks mypy quirks but I can't imagine relying on the results for anything serious.
today at 6:27 PM
I've been writing python for closing in on two decades (I want to say maybe 2.5 was my introduction point?).
I've found type hints to be remarkably useful and catch significantly more bugs than I ever would have thought, and have quickly picked up the practice of using them wherever I code. My general finding is that if I have to struggle to put useful type hints in place, I probably need to rethink my code.
I even type hint my unit tests because I've learned that sometimes type incorrectness means my tests haven't been testing what I thought they were testing.
Frameworks like pydantic[0] can help you turn those type hints into something runtime enforcing too.
[0] https://pydantic.dev/docs/validation/latest/get-started/
today at 5:28 PM
If you deal mainly with small-to-medium size Python programs, which is probably the norm, that makes sense to me. But if you have a large Python application, or if you own a library API that might have a lot of callers, typecheckers catch sooo many mistakes.
today at 6:37 PM
You can't rely on Python's type hints for serious verification, but it can be great for expressing abstractions and giving people (and, today, agents) better affordances for using them. Even static errors that will not always fire can still help a lot for using a library correctly and for noticing mismatches in your codebase as it evolves over time.
today at 5:24 PM
To be very pedantic, Python was always strongly typed in the sense that every value has a concrete type. This is very different to, e.g. C, where `void*` is often used to actually erase the type or, conversely, more abstract languages where there are only interfaces.
But of course Python function were always duck typed so it often didn't matter to the user.
today at 5:49 PM
Well, Python has a static type systems, it's just that everything has the same static type. We should call these 'unityped' languages, not 'untyped'.
today at 7:13 PM
> Check out https://counterexamples.org/
A few past discussions if anyone is curious:
Counterexamples in type systems (2021) - https://news.ycombinator.com/item?id=48718972 - June 2026 (4 comments)
Counterexamples in Type Systems: programs that crash, segfault or explode (2021) - https://news.ycombinator.com/item?id=36213704 - June 2023 (97 comments)
Counterexamples in Type Systems - https://news.ycombinator.com/item?id=27252899 - May 2021 (62 comments)
today at 4:07 PM
Aren’t some type systems (eg Lean) able to essentially verify/prove arbitrary mathematics?
today at 5:14 PM
Yes, until you introduce inconsistent axioms. Then you can prove anything.
today at 11:58 AM
[flagged]
today at 12:14 PM
There never was formal verification of the entire rust compiler, or even its complete borrow checker/type system. There has been verifications on _subsets_ of them.
Also, a lot of those soundness issues aren't related to new features _at all_, but usually due to poor assumptions made in optimizations.
The soundness bugs _are_ taken seriously though, and are slowly being patched out. A lot of the links in OP are now closed because Rust either changed how it generates code to avoid the issues, or fixed LLVM.
today at 12:49 PM
https://github.com/model-checking/verify-rust-std
hm, there's an effort but scoped only to the std
It's terrifically complex: https://doc.rust-lang.org/beta/nightly-rustc/rustc_middle/ty...
today at 12:56 PM
not of the implementation. Of the type system. And a verification of subsets, but not a verification of their interactions == the whole system is unverified.
today at 1:24 PM
The eventual goal is verification of the full system. Not the implementation, yes, that's infeasible. But this will mean all soundness bugs will be either found and fixed or we'll know how to fix them once they're found. In any way they won't be fundamental (which is believed to be the case today, but not proven).
today at 1:55 PM
so why put them in before knowing if they work reliably? That's the YOLO part, to me
today at 2:44 PM
The same combination of reasons we've been doing these kinds of heuristic implementations forever:
- people still get value off of an incomplete implementation, because we are allowed to be mindful of the issues (see, eg, UB in C++). In other words, many, many more bugs have been prevented by the borrow checker working as intended than have been caused by it working poorly. It's not particularly close.
- theory almost always moves slower than practice
The mutable state situation pointed out by the grandparent poster was a famous issue in typing SML under mutability that required serious changes in the language, see Section 4.2 here: https://smlfamily.github.io/history/SML-history.pdf
These were Turing-award caliber people figuring it out and, according to your definition, "yolo"ed it. This stuff is _hard_, and these driveby comments truly aren't helpful.
today at 2:46 PM
Because there’s real value delivered even before that? Perfect bring the enemy of good and all that
today at 2:43 PM
You're claiming that this bug that reproduces back to Rust 1.4 (2015) is a sign they're adding too many features to make sure they don't introduce bugs? Or do you have bugs that are due to these recent features?
today at 1:09 PM
It holds that ¬(∀subsets: isverified(subset)) but it's not true that ∀subsets: ¬isverified(subset), which it think most people would interpret "the whole system is unverified" as
today at 1:59 PM
If I independently verify that subsystem A properly consumes apples, and that subsystem B is properly emitting oranges, but never verify that subsystem A is receiving apples, and just connect subsystem B to it, then yeah, the system is not verified.
today at 3:42 PM
That's not the issue though.
today at 3:44 PM
you’re deeply confused but the words “validation” and “qualification” may help untangle the web, there’s a lot more to assurance than what your model seems to hold (and you’re drawing batshit deductions from it)
today at 12:06 PM
No mainstream compiler is formally proven. If you want a verified compiler, you pretty much have to choose between using a subset of standardml or a subset of C and the one proven compiler for each.
today at 12:59 PM
You're mistaking the semantics of the type system, from the implementation. I'm not talking about verifying the compiler. There's nothing to verify there.... literally. There is no spec to the language. By definition it is verified because the only verification you can do is tautological: "does this rust compiler do what this rust compiler does?"
But the unsoundness is because the type system itself, abstractly, was not verified. Or the interactions between parts. I.e. If you verified the compiler you'll find that it implements the algorithms perfectly. But tells you nothing about whether those implemented algorithms, however perfectly implemented, actually provided those guarantees.
today at 2:51 PM
They probably meant things like LLVM and the various optimization passes. None of those are verified, there’s probably all sorts of correctness issues, and yet it’s still ok. Rust’s usage also has issues and bugs emitting the right intermediate form for LLVM to consume and usually also it’s ok.
Would it be nice if we had even higher level of quality? Yes. But what’s neat is we have empirical evidence - Rust code does achieve the memory safety goals over C++ even though there’s bugs in the compiler. That’s why Rust is very quickly eating all things C and C++. A huge amount of value that the industry would just be unable to access for a long time if you waited for everything to be formally proven.
today at 7:29 PM
Okay, but verifying a type system and language specification for soundness wouldn't actually give you any of the guarantees you want if the compiler toolchain isn't verified to implement them correctly. And this sort of thing just isn't standard practice in the industry and never has been. Sure it would be nice if more things were verified, and we are somewhat headed in that direction, but it seems weird to say that rust specifically is just a bunch of half-baked yoloing because it doesn't do something that essentially no other language is doing either.
today at 12:34 PM
Wait, there's a proven subset of C? Can you point me to some info?
today at 12:37 PM
today at 12:42 PM
today at 12:15 PM
There is a massive possibility space between “yolo” and formal proof. Rust has substantial evidence of correctness. For example, unit tests and types.
today at 1:01 PM
That's verifying the implementation. The type system wasn't verified. It implements stuff perfectly, it has tests that prove it, but nobody formally verified that they perfectly implemented the correct algorithms
today at 1:09 PM
Tests are not perfect, but they are a lot better than where we were in 1990.
today at 1:56 PM
completely tangential to whether you're testing for the right thing.
today at 3:20 PM
We are a lot closer to testing the right thing today than we were in 1990!
There are pros and cons to tests, but they do some things very well. For starters a test is a lot better sign that things work as intended than a formal proof which is often so abstract most people can't be sure how it relates to what was intended. You can prove something correct that is clearly wrong. While a test will only test the one case, at least it is typically easy to understand that case and why that answer is correct. Of course if your requirements are correct your proof will tell you it is correct for all cases while a test is limited to that one case. Again pros and cons, and people speaking against tests are not honest about those.
today at 12:34 PM
[flagged]
today at 12:55 PM
I think the difference is here:
- If a compiled C++ program has unsound behavior, the program needs to be fixed
- If a compiled safe Rust program has unsound behavior, the compiler needs to be fixed
today at 2:26 PM
> - If a compiled safe Rust program has unsound behavior, the compiler needs to be fixed
Not really: the program still needs to be fixed, but fixing the compiler ensures that this unsound behavior never happens again to anyone. So you have two bugs to solve (vs C++'s one bug) but then you kill an entire class of unsoundness bugs just by recompiling.
today at 1:32 PM
That's not completely correct. If the Rust or C++ compiler has a bug in both cases either the compiler has to be fixed or the program can be adjusted to work around said compiler bug If possible. However, It's fair to argue that the Rust compiler makes more assertions and is more complex, which results in a larger error surface.
today at 1:55 PM
Which is better, surely? One fix for every program written in Rust vs everyone having to fix it themselves…
today at 1:11 PM
> If a compiled safe Rust program has unsound behavior, the compiler needs to be fixed
Can you provide an example of such a program that can’t be fixed at the program level like a C++ example?
today at 1:13 PM
Sure, usually the program can be changed to avoid the issue, but the key here is that the Rust compiler is wrong and needs to be fixed. Once fixed, the actual program fix also falls in place, as it cannot be compiled anymore.
today at 3:44 PM
That's the same kind of issue like a bug in a C++ compiler.
today at 4:20 PM
The average cause of unsoundness in a C++ program is not a C++ compiler bug
today at 7:23 PM
This is about an issue in the type checker, which would lead to unsoundness also in a C++ program. And also in Rust most causes of runtime failures are actually things that happen in `unsafe` blocks.
today at 12:58 PM
> You can be annoyed by Rust fanboys, sure, but the more annoying are the Rust haters, because the hate always comes from a place of ignorance.
For what it's worth, Rust fanboys also seem just as vulnerable to their ignorance of C/C++ compiler extensions and tooling (e.g. sanitizers, bounds annotations, standard library hardening modes and so on.) which are just normal part of professional C/C++ use today.
today at 1:25 PM
And are also woefully insufficient as proven in most sanitized & linted & fuzz-tested programs in existence (browsers and operating systems).
today at 1:31 PM
Compared to what? CVE-2025-68260?
today at 1:36 PM
Compared to, for example, 5 million Rust lines in Android, I'd say.
today at 2:59 PM
Yeah, the anti-Rust crowd seems to just hate Rust and completely ignore all the empirical evidence that professional C++, even using all the TSAN, ASAN etc still has ~10-100x the memory safety issues of Rust without any of that. I think they think “oh - use after free and out of bounds are trivial to solve” and ignore the enormously meaningful order of magnitude harder thread safety. Not to mention that sanitizers are only effective at validating the code paths exercised within the test suite. Production manages to test all the things your test suite missed. The Rust compiler verifies stricter properties about your program proof being correct in all cases (within the bounds of its own correctness of course, but that’s higher than all other code combined).
today at 7:05 PM
> “oh - use after free and out of bounds are trivial to solve” and ignore the enormously meaningful order of magnitude harder thread safety
This is what advocates of Rust are guilty of and CVE-2025-68260 is an example of it. Ultimately TSAN and KTSAN exist for a reason, and rust devs should learn how to use them effectively.
today at 8:55 PM
I'm not saying don't use sanitizers. I'm saying that even without sanitizers you're better. Also, this CVE isn't strictly a Rust problem - it's a problem creating safe boundaries around unsafe C code which was difficult even for the Rust standard library to suss out and even harder in kernel land where the rules are often not even documented. It'll take time but I don't see how this is an inditement. I can point to the myriad of CVEs the kernel has in C code regardless of sanitizers being used - what consistent and equal standard are you upholding those lines of code to.
today at 3:16 PM
Formal verification of the type system does seem a worthwhile goal, and to my understanding it's something the community has been making progress towards, but I also understand it's still relatively uncommon for most languages.
Is this more an abstract concern over the state of the industry, or is there a specific language you had in mind that you'd prefer Rust was modeled after?
today at 6:10 PM
Relatively uncommon as in there is not, as far as I know, a single mainstream language with a formally verified spec.
today at 3:47 PM
Important to note that this is is not a bug in the type system itself, it's a bug in the borrow checker not enforcing invariants that the type system says that it should, and formal verification of the type system would not have helped here.
today at 12:28 PM
The Java type system is also unsound. That’s life. It is hard to do this fully correctly. In practice this never comes up.
today at 12:42 PM
While true, there are two important differences:
1) Unsoundnesses in Java's type system are checked at runtime.
2) They (or at least some) are intentional or at least won't-fix bugs.
Both are not true for Rust.
today at 5:00 PM
The font color is so close to the background now that I can't even read your edit. Sorry, bud.
today at 12:49 PM
As you can see, this is a true statement, but HN really really really hates it for some reason.
today at 12:11 PM
Yes. When people describe Rust as "a memory-safe programming language" they are describing an aspirational vision, and not a programming language that has actually been designed with sufficient rigor to guarantee memory safety. Any failure of rustc to actually guarantee this is just a bug in rustc itself, a failure to properly implement the Rust spec, because the closest thing Rust has to a spec is literally just the vague ideal that the compiler should guarantee safety somehow.
Rust cannot fail, it can only be failed.
today at 12:33 PM
I don't think the definition of "memory safe" has ever required full end to end stack conformance with a proof. Very few languages have achieved that, though some have. Most people call Java memory safe, C#, Python, Typescript, etc - all of those fall short of a formally verified, sound type system with a verified toolchain.
today at 12:49 PM
Not to talk about Go, which has intentional unchecked-at-runtime UB (data races) yet many argue to consider it memory safe (and I have a feeling that the same people arguing Rust isn't memory safe are also there. Just a feeling though).
today at 4:39 PM
today at 1:12 PM
today at 12:49 PM
> Rust cannot fail, it can only be failed.
“Please build the perfect system. Because I specified ‘perfect’ any flaws are due to your incomplete implementation, not my awful brief.”
If the person writing the rust spec was a client I would have to drop them because they would be setting themselves up for dissatisfaction.
today at 12:29 PM
Would you say the same thing about Java? It’s type system is also unsound.
today at 12:36 PM
I'm not an expert on the Java specification, but my understanding is that Java as a language is well-defined enough that we can say things like "Java's type system is unsound", independently from any specific implementation of Java.
You can't do that with Rust because "Rust's type system" is literally just the vague concept of "a type system that is safe". The implementation of this ideal in rustc can have flaws, but Rust itself cannot, because Rust itself has no flaws by definition.
today at 2:15 PM
It is true that Rust does not have a complete formal specification for its type system which has been analyzed and proven to be sound.
You seem to be implying that because of this, Rust has no definition of its type system (other than whatever happens to be implemented in the current compiler). I would disagree.
As evidence, I would like to point out that not a single person argued that this flaw was not a bug, but was in fact the officially defined behavior. Clearly, the community has a shared understanding of what Rust's type system "ought" to do.
today at 4:29 PM
The true specification was inside our hearts all along!
today at 5:13 PM
I mean yes, part of our understanding of systems is a social one!
today at 8:14 PM
Sure, but in Rust's case the social understanding is "there exists some type system that guarantees perfect memory safety, and has the general aesthetic features associated with rustc's type system, and 'Rust' is defined to be whatever that type system ends up being".
This is a nice ideal, but it doesn't actually exist in concrete terms as a design. It can never have flaws because the definition of it is just "rustc without all the flaws".
today at 5:52 PM
Haskell is in a similar boat with regards to a missing formal spec.
today at 1:04 PM
but it isn't claiming to be saving you from things it can't prove it can either.
today at 6:11 PM
Memory safety was always a major selling point for java.
today at 12:21 PM
>Rust cannot fail, it can only be failed...
Sweet. But why should anyone care..
today at 1:29 PM
"Type systems are hard!" As hard as its safety is pushed on us, not even Rust is free from hand waving.
today at 1:36 PM
At least Rust has a chance to be largely correct because it has much greater effort per amount of code (in the compiler) invested into it than most any application code.
today at 2:14 PM
[flagged]
today at 2:32 PM
You are saying that there are only incorrect and mathematically proven with nothing meaningful in between?
today at 3:18 PM
Mathematically correct is not enough.
Java's byte code verification algorithm had a proof. This was important for running untrusted java in the browser. If it said the byte code was ok, it was.
Turns out, nobody made a proof for the verifier actually finishing. So it could return true, or false, or run longer than the universe has time. So around Java 6(?), someone wrote some bytecode that basically took forever to validate, DOSing the validator. Sun had to change the file format and add extra information to get the guarantees back.
today at 3:17 PM
Not the grandparent you were replying to, but from the note added to the original linked issue (emphasis mine):
> Rust's type system is *intended to prevent memory unsafety. Upholding this promise is something we take very seriously*, .... It is a large priority of the Types Team to *fix all type system unsoundnesses* and to work towards there being a solid foundation to minimize the risk of unknown ones.
So, yes, if you have a group who "takes very seriously" the job to "fix all type system unsoundness", I would expect them to utilize some manner of formal proof verification that their type system is mathematically correct up to some defined limit.
today at 3:33 PM
Some of it is: https://plv.mpi-sws.org/rustbelt/popl18/
today at 5:14 PM
That work is ongoing even if the RustBelt project ended. It's been a / the major focus of Ralf Jung's work for over 10 years and he's an assistant professor at ETH Zürich now, still working on it. https://www.ralfj.de/blog/categories/research.html
today at 3:19 PM
No. I am saying you don't need rust for largely correct.
PS: The term you are looking for is formally verified not mathematically proven.
today at 3:22 PM
Oh and btw their borrow checker is the kind of system that you would want formally verified.
today at 4:21 PM
No, Python has not the level of "correct" that rust has.
`sum(a:int, b:int)`
not guaranteed ANYTHING.
The gulf between how much correct Rust is and the vas majority of languages is HUGE.
today at 3:23 PM
Rust’s type system enables the possibility of discovering and fixing a bug like this, and ruling out this class of bugs for all future programs.
The hand-waving comes from other languages which can’t do anything to prevent their users encounter such bugs and the ensuing CVEs.
today at 1:45 PM
I mean, Rust's whole shtick is safety, so that's really the only thing there is to "push" about the language.
today at 2:10 PM
I wouldn’t say so… I consistently choose Rust mainly because it’s a sanely designed modern C++ alternative. It’s 20% more effort than writing Python or Typescript, and you get to use the full power of your hardware without compromise.
Safety is a nice side-benefit. The main reason why I like the safety is because it allows you to fearlessly write high-level code without being constantly paranoid about memory as in C++. It’s more about enabling ergonomics without loosing performance, rather than security or correctness.
today at 4:45 PM
> It’s 20% more effort than writing Python or Typescript
I'd disagree with this point, there is more typing involved with a first draft of code than Python or Typescript, that's certainly true, but if we bring all the tools (e.g. docblock comments for "type declaration") that are habitual to make up for the shortcomings in most developer's minds then that gap shrinks and, imo, ends up swapping. It's cheaper to have automatically enforced and consistently maintained checks than moving that information out of band and the resulting code in a strictly typed and memory enforced language ends up removing a significant cognitive overhead when reading and maintaining the code.
I have a strong aversion to boilerplate code so it's important to try and allow terse expressions when possible - but unstated assumptions are worse than overstated assumptions.
today at 3:14 PM
Most things like "sanely" and "20%" are pretty subjective. To me writing (or really reading well written) Nim (https://nim-lang.org) is less effort than writing Python or Typescript. Nim is mostly Ada & Lisp ideas packaged in a more terse & flexible surface syntax. Nim also has nice compile-time introspection and very low effort macros to allow packaging near zero-code APIs like github.com/c-blake/cligen. Also, something like 5 out of 5 times I've investigated some Rust alternative to some Nim code, the Rust ran more slowly than my Nim on my tested CPUs.
With access to inline asm, all speed is ultimately more a measure of effort applied than PLang. So those perf ideas are just "with my level of effort". Even Python via Cython has pretty direct access to asm. The "do it in pure X" that Sun popularized (even in a meta-/cross-PLang-sense) as a business attempt to define Java virtual machines as The platform has had many casualties, not the least of which is the quality of discussion of PLang practicalities, not just on HN, but everywhere.
today at 3:33 PM
I have heard great things about Nim, you may be very right. It’s just that it’s impossible to ignore the benefits of a mainstream dependency ecosystem. The ecosystem is exactly what made Python and Javascript the giants they are today, despite being somewhat mediocre languages. And the Rust ecosystem is in that same league, without giving up exceptional performance, and without giving up too much ergonomics.
PS: I was very enthusiastic about Cython for a good while and I went deep into it, but I found that it is rather a mess to use in practice. Yes you get C performance within Python, kinda, but you also get all the C footguns, amplified by the complex interactions with Python features.
today at 3:50 PM
Yeah. Other ecosystems are undeniably larger than Nim's. I keep hearing about how LLMs are going to nullify that advantage with "not so sloppy" ports of anything to any PLang, but I've yet to see that pattern materialize. "What is a clean interface" is probably a kind of subjective judgement call, but also very clearly depends on PLangs and even PLang cultures. For example, the microdependency culture of Rust/JS/Node have very little to do with the PLang's themselves.
EDIT: With Cython how I mostly kept things organized was the "caller allocation" so common in C where memory was always managed the usual mostly refcounting way of CPython/NumPy, but I had dozens (maybe even 100) little "kernels" I could pass that memory into that could even use Intel/MSFT "intrinsic" asm calls (things like immintrin.h) or even just #include C code which did similar. It didn't seem too bad to me, but Nim always seemed a more complete solution (at the PLang level - not counting ecosys). (And these days there is even NimPy (https://github.com/yglukhov/nimpy) to write low-level speed-up code for Python in Nim.)
today at 3:39 PM
There are a lot of nice things about nim, but it's absence of any kind of dynamic dispatch is a pretty serious limitation.
today at 3:46 PM
This is misinformation. There is (at least!): `method`, procedurally typed fields (inside case-object variants or not), run-time keyed `Table` with proc values, {.dynlib.}, importc/importcpp things. Beyond that, yes, Nim has rare compile-time superpowers that do lead many of its proponents to use static constructs (totally grant that!). So, you may not see a lot of dynamic dispatch in code bases, but there is little stopping you from using them in your own code.
today at 4:11 PM
Ah, yes, I should have been more precise. It doesn't have an equivalent of an interface/trait/protocol with dynamic dispatch.
Yes, you can pass around an object of procedures, but that is awkward, doesn't have any support from the language or stdlib, and from what I can tell isn't a normal thing that is done.
today at 4:40 PM
Even back in 2013 there were these ideas: https://forum.nim-lang.org/t/278
I think you & I are really back & forth-ing "the PLang not enforcing/strongly encouraging a very specific way of doing things that a whole ecosystem/community organizes around". Relying instead on self-organization has many pros & cons, to be sure. Lisp suffered much the same "until" Common Lisp (which still leaves many things open). My tag line lately is: delegation affords so much, but trust sure is tricky. Much of the time people seem to discount the often rather large cost of establishing/maintaining trust. (I'm not saying you are - just that it's an easy thing to do. I think it's why there is this is a big megathread on "trusting rust", even though "rust" is a veritable suffix of "trust". Lol.)
today at 2:24 PM
The paranoia about memory use in C++ should mostly be a thing of the past if you’re using smart pointers and sane patterns. In 2026 almost nobody should be calling new and delete and passing around raw pointers.
today at 2:57 PM
The reality though it many people are not using smart pointers. I have seen many people argue they don't like them because they want to see every place delete is called. (meanwhile of course they never notice all the places it should be called but isn't - but at least where it is they see it)
today at 3:16 PM
Personally I love to use smart pointers where bleeding edge performance is not necessary.
If I need the absolute fastest code, then that code will be tortured under valgrind. That’s non-negotiable in my book.
Code is not done until its memory management is proven correct.
today at 3:50 PM
It's more than that. Smart pointer help, but there are cases where even when using smart pointers you can encounter memory safety issues. Especially when you need to interact with c or older c++ code that doesn't use smart pointers. And smart pointers don't provide any protection against data races in multi-threaded code, like rust does.
today at 4:26 PM
smart pointers solve a different problem than data races
today at 6:17 PM
That's my point. C++ doesn't have an equivalent of rust's protections around Send and Sync.
today at 2:56 PM
And yet applications written in modern C++ are constantly discovering new memory safety issues. Sean Baxter wrote a whole manifesto talking about the shortcomings of the existing C++ model [0].
[0] https://safecpp.org/draft.html
today at 3:30 PM
The problem with manefestos is they often harp on small parts that don't matter much in the big picture. There are real shortcoming of the C++ model, but if you use modern C++ they are rare.
The real shortcoming it is very common for people to not write modern C++. I know several C++ developers who refuse to use smart pointers because they don't like magic happening.
today at 3:53 PM
It's not enough for memory safety issues to be "rare". To meet your obligations under the standard and have defined behavior (i.e. rust's basic guarantee), memory safety issues can't exist at all.
today at 4:31 PM
Ah, so this article invalidates all of the safety guarantees of rust? Since one hole was found the entire boat is shot and should be left at the bottom of the harbor?
C++ has a terrible reputation which is well associated with, say C++98, if you have a good linter you can bop people on the head for using news anywhere outside a few limited locations where you consider it warranted. All working environments have language features or even programming paradigms that are considered detrimental to code ecosystem health and fighting against these is an organizational lift when working in any programming language. Full type security doesn't mean someone can't create an overly generic object and just start breaking code contracts across the code base. C++ has an awful lot of footguns and more warts than most but it can be made to be sane for development and the new language features really bring it on par with other modern languages.
I have worked in C++ (primarily within the Qt framework which pushed hard into const refs instead of pointers) and it's fine. I've also worked in PHP which can also be fine. Rust isn't something I've worked at scale in but it certainly is very attractive if I ever jump to an org working in it - but even in Rust you'll want to restrict style divergence and bad patterns with linting.
today at 5:19 PM
I'm only talking about modern C++, not C++98. C++'s footguns include smart pointers. For example, is the following code safe?
std::unique_ptr<int> p(foo());
std::print("{}\n", *p);
today at 5:46 PM
Throw your computer away then. Rice's theorem and Godel's incompleteness theorem both make anything other than rare impossible.
These issues will exist for all time. The only question is how rare can we make them.
today at 6:17 PM
That's trivially untrue. Nothing about turing machines or lambda calculus requires temporal unsafety. Even this example wouldn't exist if the compiler rejected covariant lifetimes. You already know this of course, so I'm not going to keep beating that dead horse.
The obvious follow-up is to find a minimal set of rules that allow us to express what we want without permitting temporal unsafety. The borrow checker is one set of fairly minimal rules that works pretty damn well. Alternatively you could define away the unsafety by giving it semantics, like fil-C does.
today at 2:57 PM
C++ still doesn't have a sane modern pattern for tagged unions. If you want to define a type to represent, say, a simple parse tree, then Rust makes that easy and obvious, whereas C++ offers you a hundred options, all of which suck.
today at 5:26 PM
Isn't the obvious choice std::variant<>?
It is kind of annoying to use, but at least there is an obvious default choice.
today at 5:59 PM
I take your point about it being the default, but IMO std::variant is pretty much unusable for a parse tree. It could work for small unions that you visit once in a while, but traversing a nested tree of std::variant types is just a disaster. It somehow manages to be comprehensively worse than using manually tagged unions in all aspects except safety.
today at 3:31 PM
Idk, it also has a nicely expressive typesystem outside of lifetimes, a lot of modern syntactic features like pattern matching and monadic error handling, well-written compiler error messages, a well-designed standard library, and substantially less accrued cruft when compared to its largest competitor. Safety might be the cudgel its evangelists like to beat everyone over the head with, but there are certainly things to recommend it outside of that.
today at 2:26 PM
Rust has a lot of things that make it nice to write in. Robust enums and pattern matching are something I miss greatly when I’m back in C++. The trait inheritance system is also very flexible and I miss that. Especially compared to monstrosities like multiple inheritance.
today at 3:24 PM
Only people who don't write Rust think Rust's whole shtick is safety.
Consider reading past the hashtag.
today at 2:29 PM
Part of Rust's schtick is also cost free abstractions.
today at 3:39 PM
Neither C++ nor Rust is zero cost in many cases. Rust needs unsafe or expensive runtime primitives for doubly linked lists, an lru cache, a tree with parent pointers... Both patch the language gaps with libraries.
today at 1:38 PM
> not even Rust is free from hand waving.
It is moral though, so who cares really.
today at 11:53 AM
Took me a good couple minutes to wrap my head around. Man, what a nasty bug. I guess this specific use-case is rare. Time to see if any of the big libs are affected...
today at 12:53 PM
A nasty and rare bug can and will be exploited once it is found. The only thing necessary is for malicious actors to start adding this case in innocent looking code and there you have.
today at 12:58 PM
That's a misunderstanding. This is not a security vulnerability and Rust explicitly does not defend from malicious programs, only from mistakes. This bug however is quite dangerous, because unlike many soundness bugs it seems plausible to hit by mistake.
today at 2:48 PM
> it seems plausible to hit by mistake
The report seems to claim the opposite:
> Looking at the bug itself, it is also very likely that this unsoundness has not caused memory unsafety by accident. While it looks easy to trigger, to exploit this you need an intentionally malicious Drop implementation.
today at 2:53 PM
This edit is newer than my comment (and its writer is an experienced T-types member, so I take back my words).
today at 1:08 PM
I just wish Rust handled out of memory more gracefully like a normal error.
today at 1:19 PM
Why bother? Most systems these days have over commit and so you can never get an out of memory error. The OS will happily give you more and more RAM, and then when you try to use that memory kill a program (may or not be your program). The only out of memory error you can see is if you are trying to allocate more memory than the address space allows. This is so unlikely that nobody considers it worth bother to try to handle.
today at 2:32 PM
It is important to try, for a few reasons. Among other things, increasing amounts of Rust written in the Linux kernel itself, and other environments where you need to take more care with memory allocation.
Rust as a language is capable of that. If you don't use the standard library then you can provide that functionality yourself. The standard library is trying to support it, without creating interfaces that are a massive pain to use.
For instance, it's easy for us to support `Vec::try_reserve`, and we do, but that's not trivial for users to use everywhere; it's error-prone, and it's easy to make a mistake and call a method that goes past your reservation. It's painful for us and for users to make `Vec::push` support this (and having a `try_` variant for every function), so we've been working on a better solution. One current possibility is to have a dedicated type for a Vec that has OOM handling, where `push` can return an error, so you know if you use that type you can never accidentally fail to handle OOM.
today at 8:24 PM
> Most systems these days have over commit
Sure if you ignore the most popular desktop OS in the world.
Also overcommit (at least how Linux does it) is dumb. It leads to broken OOM behaviour (killing a totally random process, or more often locking up the system and hard rebooting). And some apps do need to handle OOM properly, e.g. formal verification systems which can use enormous amounts of memory. Jasper has to resort to monitoring page fault stats to know when it is using too much memory.
today at 10:04 PM
On a typical Linux box, overcommit and eager or confused OOM killer will ruin your day anyway.
For no_std style work where running out of memory is actually a hard limit, you have two choices:
1. disable the global allocator and use APIs that take Allocator, to force yourself to only consume APIs that can return errors from allocation. (The ergonomics aren't always great, and fattening all types with a pointer to Allocator isn't great; might be able to use a zero-sized Allocator, with trickery. Say goodbye to many libraries.)
2. use static analysis and try to avoid ever hitting a code path like Vec::with_capacity that doesn't return a Result. Make sure the tooling also analyses your dependencies. (Tooling for the static analysis is painful. And still, say goodbye to many libraries.)
I do wish there were more conveniences for alloc-can-fail APIs, like the failable version of Vec::push needs both try_reserve and push_within_capacity (nightly only).
today at 2:54 PM
the biggest design wart of rust (well one of them) is that support for custom allocators wasn't built into the type system from the start, with allocation osmething that returns Result
today at 9:53 PM
Sure, but it's worth acknowledging that that specific wart is being fixed.
https://doc.rust-lang.org/std/alloc/trait.Allocator.html
today at 2:13 PM
The emotional reactions to this stuff are so weird. Yeah, software has bugs, what a surprise. That doesn't mean that static safety is useless or that we should all just continue YOLOing stuff in C.
today at 2:55 PM
[flagged]
today at 4:45 PM
That's not how "unsafe" works at all. If "unsafe" is so commonplace in a code base that your statement becomes relevant then the project is badly run, and memory safety is just another problem among many others. Similar to accepting code with empty or nonsensical `catch` blocks.
today at 4:00 PM
You can iterate through all unsafe sections of the codebase by simply grepping for `unsafe`, the rules are followed everywhere else. It's a great improvement.
today at 10:05 PM
Even better, configuring the built-in static analysis to forbid it is a one-liner.
today at 5:27 PM
As always the same tropes get repeated ad nauseam.
Rust code using `unsafe` != C code:
-) you can encapsulate `unsafe` internals behind safe interfaces
-) you can concentrate operations requiring manual safety reasoning in small parts of the codebase
-) safety obligations become explicit
-) `unsafe` does not turn off the borrow checker, type checking, ordinary bounds checks, or automatic cleanup and you still benefit from Rust's provided abstractions and its composability
I'm not a Rust shill, and not a single programming language I use is part of my online identity, but if "Rust is a cult", the anti-Rust gang isn't?
Getting more and more annoyed by the latter to be honest.
today at 5:45 PM
Yeah, I'm always told that the Rust community is obnoxious and condescending. But I never actually see it. I do see a bunch of obnoxious anti-Rusters show up every time Rust gets mentioned to complain about it.
Also not a Rust shill, I used it for a few months about a decade ago. I am a memory-safe-programming-languages shill, though. I know there are good reasons people still use C-family languages (and I'm often one of them) but we should definitely be doing our best to move off them as quickly as we reasonably can.
today at 1:55 PM
today at 1:29 PM
I'm sure we'll get more of those on other languages / frameworks too. I tend to believe that it's for good
today at 11:06 AM
Worked on a variance-related lint once and the scary part is how rarely anyone writes down variance by hand, so bugs there just sit untested for a decade.
today at 1:34 PM
Nobody writes variance at hand in Rust because it's impossible (since before 1.0). You sometimes need to enforce stricter variance than the default (can cause unsoundness and is very subtle but actual unsoundness here is rare) or give more permissive variance (harder and also cannot cause unsoundness, just annoyance).
When implementing the type system, however, variance does have to be treated with care. Historically it wasn't much, now it is.
today at 11:18 AM
today at 1:57 PM
The question is. If rust used rust would that have prevented this?
today at 3:16 PM
Rust does not prevent all bugs, only certain ones (that are common and dangerous).
today at 5:57 PM
The Rust compiler (rustc) is written in Rust, but there can always be bugs in the compiler, regardless of whether it's written in a memory-safe language or not.
today at 4:02 PM
Rust allows for type-proofing your logic, but it can't force you to.
today at 2:08 PM
no
today at 11:06 AM
The heart of the matter:
struct Q<T: 'static>(Option<T>);
impl<T: 'static> Drop for Q<T> {
fn drop(&mut self) {
// Code in here has access to a non-'static &String
// but assumes that it's a &'static String
}
}
fn main() {
let l = String::new();
let mut q = Q(None);
q.0 = Some(&l);
}
today at 11:38 AM
> I wonder if the certified compiler for safety critical uses has the same issue.
It uses the same code, so yes.
(Although I don't know what are their guidelines, it might be that they require avoiding code relying on implied bounds, for example).
today at 2:47 PM
today at 12:13 PM
Can someone ELI5 for people who don't know Rust (but e.g. C)?
today at 12:34 PM
Rust is supposed to guarantee statically that a reference cannot outlive its referent. The `T: 'static` bound means that the value that Q holds must have a 'static lifetime (e.g. either be an owned value or a reference to a static value). So this program should not compile since a reference to l is not 'static. This code is unsound because rust will drop the string l before q so when the Q destructor runs the underlying string has already been freed yet we have a valid reference to it.
today at 12:59 PM
So the equivalent in C would be:
$ cat main.c
#include <stdlib.h>
#include <string.h>
struct Q {
/*@null@*/ /*@only@*/ char * t;
};
/*@only@*/
struct Q *
Q_new (/*@only@*/ char * t)
{
struct Q * q = malloc (sizeof *q);
q->t = t;
return q;
}
void
Q_set (struct Q * q, /*@only@*/ char * t)
{
free (q->t);
q->t = t;
return;
}
void
Q_free (/*@only@*/ struct Q * q)
{
free (q->t);
free (q);
return;
}
int
main (void)
{
/*@only@*/ char * l;
/*@only@*/ struct Q * q;
l = strdup ("");
q = Q_new (NULL);
Q_set (q, l);
free (l);
/* This is UB */
Q_free (q);
return EXIT_SUCCESS;
}
$ splint main.c
Splint 3.1.2 --- 21 Feb 2021
main.c: (in function Q_new)
main.c:15:3: Arrow access from possibly null pointer q: q->t
A possibly null pointer is dereferenced. Value is either the result of a
function which may return null (in which case, code should check it is not
null), or a global, parameter or structure field declared with the null
qualifier. (Use -nullderef to inhibit warning)
main.c:14:17: Storage q may become null
main.c: (in function main)
main.c:43:6: Unrecognized identifier: strdup
Identifier used in code has not been declared. (Use -unrecog to inhibit
warning)
main.c:44:13: Null storage passed as non-null param: Q_new (NULL)
A possibly null pointer is passed as a parameter corresponding to a formal
parameter with no /*@null@*/ annotation. If NULL may be used for this
parameter, add a /*@null@*/ annotation to the function parameter declaration.
(Use -nullpass to inhibit warning)
main.c:47:8: Dead storage l passed as out parameter to free: l
Memory is used after it has been released (either by passing as an only param
or assigning to an only global). (Use -usereleased to inhibit warning)
main.c:46:12: Storage l released
main.c:12:1: Function exported but not used outside main: Q_new
A declaration is exported, but not used outside this module. Declaration can
use static qualifier. (Use -exportlocal to inhibit warning)
main.c:17:1: Definition of Q_new
main.c:20:1: Function exported but not used outside main: Q_set
main.c:25:1: Definition of Q_set
main.c:28:1: Function exported but not used outside main: Q_free
main.c:33:1: Definition of Q_free
Finished checking --- 7 code warnings
today at 2:07 PM
If you wrote a Q_free function and called it after `free(l);` to actually demonstrate the UAF, that would be pretty close to the semantics of the Rust example.
today at 2:26 PM
I have added that now.
I originally didn't do this, because I didn't feel the need to invoke UB without necessity. Also I wanted to demonstrate, that the error can (and is) caught in C, without actually committing the double-free (so that the program behaviour is still well-defined, but the abstraction is already violated).
today at 3:27 PM
I'm not familiar with Splint, but my understanding is that the error is because of the @only@ marker indicating that the string is not shared. That's an incorrect translation of the Rust program, where the reference to the string is explicitly a shared reference rather than an owned reference. The issue isn't the sharing; it's that rustc mistakenly allows the code to assign a reference that is valid until the end of the current scope to a field that expects a reference valid forever (like a string constant in the program binary). The Rust program with equivalent semantics to your C program (passing an owned String instead of a shared reference) is correctly rejected by the compiler.
Also, the Q_free function should not free q->t. It may access it (e.g. printing it), but it does not own that reference and is not responsible for deallocating its memory.
Sorry, I should have looked closer the first time! My excuse is that it was too early in the morning to be thinking about such things.
today at 3:45 PM
Yes, @only@ means that the parameter/variable is owning. I believed that would have been the meaning in Rust. Now I can no longer edit my comment, oh well.
> Also, the Q_free function should not free q->t.
Well, that's because I thought it would own it. But if in Rust it is not implied that the Q owns the string, then I fail to see where the error is? Both l and q will be deallocated at the end of the main function. Depending on the order of the deallocation maybe q exists for a theoretical time while pointing to already deallocated memory. But both get deallocated at the same point, so q does not outlive the existence of l, so where is the error?
today at 3:53 PM
The error is the destructor of `q` could look at the reference and stash it away somewhere, like a global variable (since the compiler thinks the reference is valid forever). Then, some other part of the program could access that variable and cause a UAF.
today at 2:04 PM
> rust will drop the string l before q
Why?
today at 3:57 PM
That's incorrect; the compiler drops q before l. Drops happen in LIFO order; and the compiler knows that it can't drop l before q has been dropped, because q contains a reference to l.
The issue is that the destructor of q can observe a reference which is about to be deallocated as having a 'static lifetime (i.e. it will live forever), and can thus stash it away somewhere for other code to access after it's been freed (as in the examples in the issue which demonstrate UB.)
today at 2:29 PM
My thoughts as well. The problem can be alleviated either by making the ownership change an error or "just" invoking the destructors in the correct order.
But I think https://news.ycombinator.com/item?id=50072252 answers it:
A 'static lifetime constraint on T says: types that satisfy T must not contain any borrowed value/content whose lifetime will be shorter than the life of the program.
today at 12:38 PM
What does "q.0" and "Some(...)" mean?
today at 12:57 PM
So Q is a "tuple-struct". In rust you can define a struct like
struct Q<T> { value: Option<T> }
with a named field or you can define it like
struct<T> Q(Some<T>)
which is the same struct layout but without an explicit name for the value. In that case, the field is implicitly names `0`
So q.0 = Some(foo) is equivalent to q.value = Some(foo).
The Some(..) is just one variant of the Option enum:
enum Option<T> { None, Some(T) }
Option represents a value that may or may not be initialized. For uninitialized values you use the None variant and then you can initialize it to Some(value).
The C rough equivalent would be
struct Q { void* value; }
struct Q q = q { NULL }; q->value = ...
today at 12:54 PM
Some(...) is just constructor for an option type as seen in other languages e.g. java's Optional, haskell's Maybe, c++'s std::optional. I assume that it's needed here because the field can't start as a null pointer otherwise. Maybe the vulnerability still works if the field starts with one string value and swaps to a different string value, but having it start holding None made for a simpler demo.
q.0 is the first field of q, which is anonymous. They could have just as well called it x and written q.x.
today at 12:53 PM
"Some(...)" means that this Option<T> does have a value of type T in it; "None" means it doesn't.
"q.0" is not really needed, it's a struct with unnamed fields. Here is the same with named fields:
struct Q<T: 'static> { pub x: Option<T> }
...
let l = String::new();
let mut q = Q { x: None };
q.x = Some(&l);today at 12:56 PM
today at 2:23 PM
'static lifetime bounds are kind of confusing in Rust, but here goes: A 'static lifetime constraint on T says: types that satisfy T must not contain any borrowed value/content whose lifetime will be shorter than the life of the program. So suppose you have a string s, and Option<&String> q. If q has the constraint 'static, and you do q = Some(&s) this should be rejected by the compiler since a reference to s gets a shorter lifetime than 'static by default (you could do q = Some(&'static s) if s is say a string literal or a leaked box but not for a normal string). In the examples it looks like you have to use a tuple to trick the borrow checker but the concept is the same: Rust allowed violation of the 'static lifetime bounds. The drop implemenation demonstrates it: drop happens in reverse declaration order, so the string s gets dropped first. Now q has a dangling reference, a pointer to dropped memory essentially, and we get a pretty classic use after free bug.
today at 11:10 AM
which compiler?
today at 11:12 AM
Ferrocene
today at 11:22 AM
DeepSeek v4.1 Flash thinks it should NOT compile. Whereas in reality it DOES compile which is why it is filed as a bug.
today at 11:33 AM
They're seriously using AI as a judge for what to file?
today at 11:37 AM
The issue and none of the comments mention AI. It is pretty clear your parent said it by themselves.
today at 11:37 AM
I was just checking what outcome an LLM would have based on the patterns in its probabilistic distribution it has seen the wild.
Most LLMs would probably say this piece of code won't compile.
today at 12:08 PM
chatgpt and grok linked to the the soundness issue, claude I am in usage timeout, and gemini shit the bed as usual: "The compiler rejects the program with error[E0597] on the assignment q.0 = Some(&l)"
today at 9:38 PM
Beg, Borrow, or Steal: a guide to Rust object ownership
today at 11:08 AM
There is a collection of these someplace. Rust is better but it'll never be perfect, news at 10
today at 11:38 AM
Rust is good, I generally do not dislike it - but it does have flaws.
I will happily continue to write things in Golang first. I don't enjoy refactors in Rust, and it's rare that I see things that genuinely need its raw performance.
Cloudflare's Oxy is a stellar example of build in Golang till your design is settled and then port over for performance when you need it.
today at 11:27 AM
today at 11:00 AM
What the hell. This is not the esoteric, crazy, impractical constellation I expected to find with a title like this. The minimal example is so simple and is definitely something you'd easily come across in normal code.
today at 11:10 AM
For a long time `loop {}` was undefined behavior. Lots of l-unsounds are really nuts but a few are not.
The reality is that if this were actually code that people wrote, well, it wouldn't have sat around for a decade.
today at 12:42 PM
Afaik loop {} has never been UB, however because llvm started as a c++ compiled where it is, this has been causing miscompilations in rust and C for… nearly two decades (llvm issue 965).
today at 5:32 PM
Sure, I think it was still under the same unsound tag regardless.
today at 6:37 PM
Unsoundness and UB are very different things, UB tells users of the language "don't do that it's wrong", unsoundness tells users of the language "be careful we need to fix that", it's a bug.
today at 12:51 PM
Since the Rust language is defined by the Rust compiler and has no other specification, if it's UB in the compiler then it's UB in the language.
today at 2:19 PM
And this, kids, is how you get called Billy Madison.
May god have mercy on your soul, cowlevel1.
today at 2:45 PM
Rust has no formal spec? Really?
today at 4:39 PM
It's a work in progress. The Reference (https://doc.rust-lang.org/reference) is slowly getting more complete over time. Other ongoing efforts include a-mir-formality (https://github.com/rust-lang/a-mir-formality), minirust (https://github.com/minirust/minirust), the FLS (https://github.com/rust-lang/fls), and Rust via Desugarings (https://nadrieril.github.io/rust-via-desugarings/). But writing a 100% complete and correct formal spec is hard! Not even C gets this right, the C standard has holes which lead to miscompilations and UB in practice: https://www.ralfj.de/blog/2020/12/14/provenance.html
today at 12:20 PM
> is definitely something you'd easily come across in normal code.
The fact that nobody reported this before means it's not, by definition.
today at 1:08 PM
Not at all. There are way more valid lifetimes than the lifetime system of Rust can express. There are countless scenarios where you could accidentally use the unsound behaviour while not producing a segmentation fault because the lifetimes happens to be arranged such that no invalid memory access actually happened.
A program isn't invalid just because it violates the ownership and borrowing rules of Rust. There are tons of programs in the world with shared, mutable access, devoid of Mutexes, Arcs and Locks that nonetheless are completely valid.
today at 1:24 PM
I think you are talking about a different problem and that has nothing to do with my comment.
today at 2:18 PM
Simplified, the point is that a lot of badly typed code that this bug lets through might be mostly harmless (or even fully semantically correct, in some instances). So you can't conclude that 'normal' code wouldn't trigger this bug just because no-one's noticed it until now. The bad code could could be happily executing and performing as expected.
today at 11:05 AM
I wonder if the reason it works is because you'd easily come across it in normal code, and someone didn't realize that saving the effort of implementing a check for this would result in unsoundness.
today at 1:32 PM
That's not how it works. rustc doesn't "check" for specific cases explicitly, the borrow checker (apparently at fault here by reports) has a set of rules that should reject invalid programs. So either one of the fundamental rules was broken (unlikely here from what I've heard), or some optimization caused the rules to not be implemented correctly.
today at 9:33 PM
I know the borrow checker uses rules, but I don't know enough about the internal implementation details to use fully precise terminology. I don't mean borrow checking is just a chain of if-statements or something. I meant check in the abstract.
From the GitHub thread: "I think unification just generally doesn't check lifetime bounds of the type." [0]
There are steps, or rules or whatever, that perform soundness (or well-formedness or whatever) checks. And clearly one was missing.
My guess was just that maybe someone didn't think it was necessary for soundness.
[0]: https://github.com/rust-lang/rust/issues/164250#issuecomment...
today at 11:08 AM
Not really. I've worked with rust for 4 years, systems side, and never had to write a custom drop implementation. That's the gotcha here, not the rigamarole with the static+Send option type (which _would_ be something you'd encounter in prod).
today at 11:18 AM
I've written dozens of custom Drop implementations. Well, many of them are named cleanup because of the async Drop mess in Rust, but...
today at 12:26 PM
How many of them only conditionally implement Drop, based on a generic param lifetime?
today at 12:38 PM
Why would you ever conditionally custom impl Drop? I don't think I've ever seen that pattern, and I can't think of a use case.
today at 5:05 PM
Therefore explaining why the bug hadn't been hit in practice for 11 years.
today at 8:57 PM
The bug in the OP is about UNconditional impl. And honestly, looks like very standard code, definitely something that could've been written for real. I can't even explain why it passes checks, it clearly shouldn't.
today at 9:50 PM
This code, from the bug submission?
impl<T: 'static + Send> Drop for Q<T> {
fn drop(&mut self) { if let Some(t) = self.0.take() { KEPT.lock().unwrap().push(Box::new(t)); } }
}
today at 12:29 PM
OK. That's good to know. I'm not sure why sharing our professional experience with this type of code is controversial, but here we are.
today at 11:31 AM
That's easily the exception rather than the rule. I've seen custom `Drop` implementations in almost every non-trivial Rust codebase I worked on.
today at 11:42 AM
A custom `Drop` appears very quickly with FFI code. Suppose for example you interface with some C library that expects you to call a function to release some resources.
today at 1:41 PM
today at 12:26 PM
Now we are at the phase where, Rust is “safe” but only if you use it “correctly” and without using X language feature or a custom Y feature.
This is the problem when a language advertises with “guarantees” and it turns out it never had any due to many false assumptions by their promoters.
So what other soundness bugs are there in the language that we need to know about?
today at 12:28 PM
I'm not defending rust here - a correctness bug invalidates the premise. But I am saying that I've never seen a custom drop in production.
For some reason this is controversial, but it remains true.
today at 12:46 PM
You said/implied 2 things:
- you've never written a custom Drop
- "Not really". Implying that your experience generalizes
I've written a bunch of rust programs without custom Drop. I believe your first statement. There are large classes of programs that don't need it. There are also many that do. I think your statement says a lot more about what kind of programs you work on than about custom Drop not being common. People are downvoting the implication that custom Drop is not a common pattern.
today at 12:32 PM
Custom drops are all over the place. As others have said.
But not custom drops that are doing variadic type stuff like this, usually.
today at 12:31 PM
No we're in a situation where a bug in the type checker was found and will be fixed and a new release will be made.
That it took 11 years for someone to come across this is a fairly intense counterargument to your attempt to paint this as a language with dangerous footguns.
today at 3:26 PM
[flagged]
today at 4:14 PM
A gun in a glass case with a warning label reading "do not aim at foot"?
today at 11:04 AM
I don't understand how something like this could take so long to be discovered. Pretty crazy stuff.
today at 11:22 AM
> I don't understand how something like this could take so long to be discovered.
Maybe they wrote it in C :-)
On a serious note, old software is generally more trustworthy than new software, because bugs are discovered over time and with usage.
today at 4:53 PM
> On a serious note, old software is generally more trustworthy than new software, because bugs are discovered over time and with usage.
The age of software means bugs are more likely to be discovered but not necessarily fixed. In the case of Rust, the developers have documented a whole lot of unsoundness bugs that require a new borrow checker architecture to fix.
today at 11:49 AM
Old C software is generally more trustworthy than new C software. I don't think this rule of thumb transfers across languages very well. And the definition of new vs old has a fairly large effect. If a language has been under constant change it doesn't matter when it was started a large part of the codebase is "new".
today at 12:21 PM
Because it's rarely used like this, just like weird bugs caused by edge cases found in all kinds of software in the world.
today at 11:16 AM
today at 2:02 PM
[flagged]
today at 3:38 PM
[flagged]
today at 7:25 PM
[dead]
today at 11:14 AM
[flagged]
today at 12:08 PM
This is not the first soundness bug. Some bugs aren't fixed for years. The Rust community is well aware that such bugs exist, will be found, and address them just like other high impact bugs. In other words, if you paid the slightest attention to the development of Rust language, you would know this is surprising but not unexpected, and has happened many times.
today at 12:26 PM
Given that TFA is currently #1 on HN, I suspect I'm not the only person who is aware of Rust's borrow checker but not aware, until now, that it has a history of serious soundness bugs.
today at 1:20 PM
> I'm not the only person who ...
This is not even the first soundness bug that appeared on HN frontpage. It just means you don't pay attention to Rust development, that's it. I don't even use Rust at all yet I know a number of quirks about its compiler.
today at 1:33 PM
> This is not even the first soundness bug that appeared on HN frontpage.
This is not a counterargument to my claim that "#1 on HN" status implies that many people are surprised by this.
> It just means you don't pay attention to Rust development
Correct, I don't. I never said that I did.
today at 1:54 PM
Sure. So if that's what you come here for,
I hereby confirm that you are not the only person who is aware of Rust's borrow checker but not aware, until now, that it has a history of serious soundness bugs.
Hope that settles this meaningless exchange.
today at 3:21 PM
The reason it's #1 is because this bug is so simple to trigger.
today at 12:59 PM
Well, it has a history of soundness bugs.
"Serious" soundness bugs? That's a stronger claim, and one that you introduced. So you have the burden of proof. Which of those soundness bugs are serious, and what about them makes them so?
today at 1:26 PM
From TFA:
> How on earth was this not found before this???
https://github.com/rust-lang/rust/issues/164250#issuecomment...
> Assigning P-high
https://github.com/rust-lang/rust/issues/164250#issuecomment...
In general I agree with fg137's assessment of soundness bugs as being inherently high-impact, i.e., serious:
> The Rust community is well aware that such bugs exist, will be found, and address them just like other high impact bugs.
today at 12:18 PM
People in sugar glass houses shouldn't throw stones :P
today at 11:45 AM
You got my upvote and this one decade old issue:
https://github.com/rust-lang/rust/issues/25860
today at 12:57 PM
Is this the one exploited in cve-rs?
today at 11:27 AM
[flagged]
today at 11:39 AM
You got my upvote.
today at 1:06 PM
And I laugh at downvoters.
today at 12:57 PM
[flagged]
today at 1:16 PM
It seems the bug here was caught by Asan instead of at compile time, so basically, for this one bug, rust is reduced to C++-like behavior. You’re still better off using rust because of all the bugs the borrow checker does catch.
The practical upshot to me is that you should be running your rust tests under asan.
today at 2:58 PM
[flagged]
today at 3:32 PM
That was a bit generic and easy to swap "Rust" for whatever...
Dense syntax pulsing
Writhing and undulating
What designer, who?today at 1:38 PM
[flagged]
today at 11:18 AM
[flagged]
today at 11:34 AM
It looks like 18 of the 30 issues listed in table 4 had already been fixed when that paper was released, and there is activity in most of the rest. One was recently flagged as being fixed by -Znext-solver, and another has the submitter write that it is fixed, but the issue is not closed. And that's before you consider the impact of the individual issues; how many of the remaining issues impact "real" code?
So I don't think it's fair to claim that "no-one cared".
today at 11:34 AM
I don't think "no one cared" is a fair characterisation. The paper doesn't support this conclusion, and from experience I'd say that the two difficulties in fixing unsoundness are doing so without breaking existing code (Rust guarantees stability unless the code is unsound, and introducing previously missing checks can cause sound code to stop compiling, which is a problem if it occurs often) and doing so in a reliable way that can be supported long-term. Rust is currently in the progress of stabilizing next-solver and Polonius, both of which fix multiple long-standing bugs and have been worked on for years now due to intrinsic complexity, performance considerations, compatibility issues, etc. It's not that no one cares, it's just that this stuff is hard and takes time.
today at 3:24 PM
The borrow checker has been rewritten to improve this once, and another attempt (that is thought to clear up the rest) is on the way.
Things taking time to fix is not the same as not caring.
today at 3:17 PM
today at 11:04 AM
[flagged]
today at 11:09 AM
lol do you think that cve-rs was required? there is literally an l-unsound tag on rustc's github, this isn't some embarrassing or secret thing.
Safe rust is safe, granting `unsafe` and compiler errors. This isn't a secret.
today at 11:14 AM
What's l- here? Literal?
today at 11:32 AM
"I" stands for "issue"
https://github.com/rust-lang/rust/labels?q=unsound
today at 12:11 PM
lol I was writing `l` because I thought it was `labeled-unsound` for like a fucking decade
today at 11:10 AM
in compare to c and cpp? it is
today at 11:14 AM
And in absolute terms?
today at 3:19 PM
All memory safety on von Neumann architectures is specified with respect to a TCB. For Rust, the TCB includes the compiler. The TCB can have bugs. This doesn't invalidate the memory safety promise, given that it is made with respect to the TCB.
In contrast, memory-unsafe languages don't even try to have a TCB relative to which memory safety is specified. That's the main difference.
today at 11:24 AM
Literally nothing can be anything in absolute terms, what's your point? The fact is that Rust is miles better than any other language in terms of memory safety & performance ratio. That's all that matters.
today at 3:30 PM
[flagged]
today at 5:55 PM
The entire industry right now seems to think otherwise :)
today at 12:43 PM
"People still die in cars despite airbags and seatbelts so I don't see the point in wearing a seatbelt."
today at 11:48 AM
cmon, it is time move on.
it has been discussed bilion times
today at 11:18 AM
Let us not conflate a bug in an implementation (rustc) with a defect in the language (Rust).
today at 11:26 AM
AFAIK there isn't a language spec. Rustc is the language for now.
today at 11:41 AM
But bugfixes are also allowed. So the fair conclusion is that the implementation is broken, but the language is not - because it's possible to fix, and it's possible for all known soundness issues (including the cve-rs one). For this one specifically, I've heard people are already working on a fix.
today at 11:51 AM
[flagged]
today at 11:44 AM
My understanding is that it is work in progress, via Ferrocene.
today at 4:29 PM
Ferrocene is not a separate implementation of the compiler. It's the same Rustc, just a few versions behind and with a bunch of regulatory approvals attached. There is ongoing work on fixing all the unsoundnesses, happening as part of the main compiler development: https://goals.rust-lang.org/2026/roadmap-project-zero.html
today at 11:59 AM
Ferrocene has his same flaw
today at 12:11 PM
If that's the case then I was wrong.
today at 11:25 AM
Which clause of the language specification is being violated?
today at 11:46 AM
Lifetimes can be effectively erased via covariant assignment. It's in the title. Even a beginner could understand these assignments are not in spec? Are you just being contrary to be contrary?
today at 11:57 AM
If that's the definition you're using, then C is also a safe programming language. In fact, C is even safer, because it actually does have a specification that lists all the invariants that the programmer has to uphold themselves because the compiler doesn't check them.
today at 6:07 PM
> In fact, C is even safer, because it actually does have a specification that lists all the invariants that the programmer has to uphold themselves because the compiler doesn't check them.
The difference is that the C spec intentionally frees the compiler from upholding those invariants. In this case the Rust compiler is failing to catch something it is required to catch.
A more accurate analogy would be a C compiler incorrectly failing to reject an assignment through a pointer to const without a cast. The spec requires that such a thing be rejected, so it's a compiler bug.
today at 11:52 AM
So point to the spec
today at 12:14 PM
https://public-docs.ferrocene.dev/main/specification/types-a...
Specifically the `q.0 = Some(&l);` violating 4.15.2:40 ("An assignment expression requires that the type of its value operand is a subtype of the type of its assignee operand.")
today at 12:58 PM
That's a pretty basic property of any language. Why does the rust compiler fail to enforce it in this case?
today at 1:06 PM
> Why does the rust compiler fail to enforce it in this case?
A bug. The one linked, that we're all talking about.
Feel free to share a link to any software that has zero bugs.
today at 12:00 PM
this is probably a great opportunity for rust to get one, if they want to be taken seriously
today at 12:18 PM
I totally understand that people have favourite languages and that rust, like any language and any ecosystem around that language, has idiosyncrasies that are not for everyone, but how would one ever come to the genuine conclusion that rust is not being taken seriously? By whom?
today at 1:12 PM
[flagged]
today at 1:17 PM
Hey, but it's genuinely a nice language. Maybe they're not the most brilliant of type theorists, but even without ownership/borrowing, just stuff like traits, structs/enums/unions with pattern matching, etc, is done quite well.
today at 1:15 PM
What's wrong with Wales?
today at 1:16 PM
The tech of the rust language is real though and is providing real world value
today at 11:39 AM
very very good job
today at 12:00 PM
Here's the weakness of compiled programs. Does this compiled code have this vulnerability? You have no idea. At least with a VM or interpreter you can scan for vulnerable versions and replace the runtime or the specific library.
With this you have to recompile everything
today at 12:56 PM
It's possible to scan compiled programs at the assembly or machine code level. Not enough people do, which is fair enough because it's a slog, but it makes all compiler UB transparent to the analysis.
today at 12:26 PM
That is less and less true by the day, for better or worse.
today at 1:27 PM
And a fork fixed it before upstream rust :)
today at 3:42 PM
...yes? that's usually the case in open source software.
today at 4:54 PM
Was this done by LLM? this is a doubt. because recently we are seeing many such bug reports.
today at 11:53 AM
wonder what happened to this https://raphlinus.github.io/rust/2020/01/18/soundness-pledge...
today at 12:11 PM
I think it has no relevance here at all. Actix was unsound because of prolific use of unsafe. That was a poor design decision but a conscious one. TFA is just a bug.
Having ideals does not mean there are never bugs.
today at 11:59 AM
What do you mean?
today at 1:57 PM
I think one social issue I’m seeing is that the Rust community bashes other languages for safety but then glosses over or even completely ignores their own safety risks (see supply chain). I would rather see Rust focus on its actual features without bashing others and maybe start moving away from claiming the gold metal on security. Being less toxic is always a good thing for long term health.
today at 1:59 PM
It's important to separate the community ethos and the rust core dev team policies, because I'd be surprised if the official stance of the rust team would be condescending to other technologies.
today at 4:58 PM
Rust is my favorite language in most domains I program in; I've learned to ignore the online rust OSS community due to a mix of preferring heavy abstractions (then shaming your code if you don't use them), and rude behavior.
This is fine, for the reasons you state: I can use the language and tools while ignoring the jerks.
today at 2:15 PM
Have you met humans?
I’d be shocked if people working on and passionate about thing didn’t shit on other thing. That’s natural and even good in moderation. It’s up to a leader to keep it under control.
today at 2:16 PM
Yes. In fact, I have met quite a few humans who make a point NOT to go bashing the work of others. (Of course, I have also met quite a few who do spend their time bashing others.)
today at 4:17 PM
The more you understand about your own system the more humility one would think you would have. This is like the dumb guy to jedi meme. It's the people in the middle that shit on other peoples' work because they have something to gain by looking comparatively smarter.
today at 5:53 PM
the only thing more exhausting than rust evangelism is people who drop in on any rust related thread and start whining about unrelated things just because it's rust.
today at 2:11 PM
Can you give an example of this toxic bashing from rust contributors or are you talking about just random HN posters when you say “rust community”?
Moreover, I wouldn’t say they’re completely ignoring supply chain risks, as there have been discussions about this as early as 2021 [1] and there are ongoing efforts to address this [2]
[1] https://internals.rust-lang.org/t/about-supply-chain-attacks...
[2] https://kerkour.com/fixing-rust-supply-chain-security
today at 2:31 PM
Yeah Ive actually never seen any Rust team members be toxic. Keep in mind there is a micro niche of tech influencers who try to politicize rust because they associate it with liberalism or something like that and paint Rust community as an opposing force to some status quo they think exists or should exist. Those notions have taken on a life of their own.
People who say this just dont know what they're talking about and are repeating youtubers and X takes.
today at 2:49 PM
[flagged]
today at 5:10 PM
> Even the basic logic is flawed.... That coders can't be trusted to handle pointers, but somehow can be trusted to write "safe" unsafe rust.
Who said anything about trust? The purpose of unsafe blocks is that you have specific, limited areas of your code that can be audited for safety. With C your entire codebase needs to be audited.
Also, other languages “trusting” people to use pointers correctly has gone pretty badly.
today at 4:57 PM
The only fanaticism I'm seeing here is you going through the entire thread and picking fights and calling people who use and advocate a language names.
"fans" "fanatics" "cult"
I'm not sure what the point of this way of talking is. Rust is a tool. Many advocate for it because we've worked for a long time in ... other tools. Which had avoidable problems. I had a two decade career with C++ before Rust finally became mainstream enough to get paid to work in. Going back here and there is usually... unpleasant.
today at 2:31 PM
Dream on
today at 3:11 PM
> being less toxic
There's a difference between people you disagree with and toxic behavior. Can you give examples of toxic behavior?
today at 10:30 PM