News for hackers. Stuff that matters.
Re:Maintain It with Zig by mumblemumble on Wednesday September 08, 2021 @01:57PM (#28460747)
disclaimer: I haven't actually used either, just done a lot of interested reading and a little toying around.

One thing that impressed me about Zig is how simple the language is. I get the impression that it would take very little time to properly learn the language and become effective at it.

Rust, on the other hand, has a whole lot of complexity even without the ownership semantics. So much to learn and understand. And, in some cases, work around. It seems, from looking at others' code, that there is a very strong temptation to lean on `unsafe` instead of figuring out how to solve a problem within the constraints it normally applies.

That has me wondering if there's really all that much safety difference in practice? Simpler code is generally easier to understand, and it's generally easier to find and fix bugs in code that's easier to understand. I can imagine a world where it's a tradeoff between, "You definitely won't have any of this relatively narrow category of bug, unless of course you opt out of the static checks, which you will probably do sometimes, even though we tell you you shouldn't," and, "There are no particular guarantees, but you're generally less likely to have any of this broader category of bug."

Re:Maintain It with Zig by steveklabnik on Wednesday September 08, 2021 @02:03PM (#28460848)
"simple" is, unfortunately, not a simple concept, nor does everyone agree on its effects on programs written in a language that is or is not simple.

Some people do believe that, let's say "conceptually parsimonious" languages (using complicated words to describe simplicity is amusing to me, sorry) do exactly what you say. Others believe that complexity inherently exists, and you can put it in the language, where a compiler can tirelessly check certain properties for you or a runtime can do magical complicated work on your behalf, or you can put it in the programs, where users have to check such things themselves.

Another way I heard this expressed one time is Ruby vs Python. I once heard someone talk about how they preferred Python as a language more, because it was simpler, but enjoyed actually programming in Ruby more, even thought it was more complex, and they value simplicity. The reason is that all of that nasty ugly stuff Ruby lets you do makes you be able to make extremely nice APIs. Things you couldn't do, or just folks don't do, in Python. And therefore they ended up liking using Ruby more in practice.

I suspect that this is a topic that we, as a profession, will debate about endlessly.

Re:Maintain It with Zig by pron on Wednesday September 08, 2021 @04:18PM (#28462486)
> Others believe that complexity inherently exists, and you can put it in the language, where a compiler can tirelessly check certain properties for you or a runtime can do magical complicated work on your behalf, or you can put it in the programs, where users have to check such things themselves.

I think we'd all agree there's a spectrum, with, say, Assembly on one end and Idris on the other, where neither Zig nor Rust are near either extreme, and are actually rather close to each other. It's not a matter of accepting or rejecting a principle, but on picking slightly different sweet spots (hopefully) on a tradeoff spectrum.

Rust doesn't check at compile-time most things that could be checked at compile-time. In fact both language check almost the same things at compile-time, and almost the same things at runtime. The design differences come down to one or two things that are clearly tricky and that neither language "does for you" -- i.e. you still need to think about them -- but are, indeed, checked in different ways.

Re:Maintain It with Zig by steveklabnik on Wednesday September 08, 2021 @04:25PM (#28462578)
Yep. I agree they’re closer to each other than the extremes for sure.
Re:Maintain It with Zig by dman on Wednesday September 08, 2021 @02:18PM (#28461067)
There is also the notion of languages you love writing code in vs languages you like reading code in. Languages with more powerful abstraction abilities bring joy to the writer but make things tedious for the reader.
Re:Maintain It with Zig by paavohtl on Wednesday September 08, 2021 @02:23PM (#28461115)
I don't agree with that. For example, I think it brings me joy as a reader that I can tell at a glance from a function signature which arguments are modified and which ones are just read. Without the abstraction of mutable and immutable references I would have to read the entire source code of the function and every function it calls to know for sure what it does with the pointers. It also brings me joy as a reader that common functionality like equality comparisons or string formatting can be derived by the compiler, instead of having separate hand-made implementations for each data structure, which might have subtle differences.
Re:Maintain It with Zig by steveklabnik on Wednesday September 08, 2021 @02:26PM (#28461161)
Totally.

I personally would not agree with

> Languages with more powerful abstraction abilities bring joy to the writer but make things tedious for the reader.

I find map/filter to be easier to read than a C-style for loop. Things that are conceptually denser make discussion between experts easier, even if it makes things harder for non-experts. This is why jargon exists, for example.

Re:Maintain It with Zig by dman on Wednesday September 08, 2021 @02:34PM (#28461262)
Ah yes - that makes sense. I should have been more precise - I meant abstractions that allow you to add opaqueness (like macros and operator overloading). Again culture plays a role here too - some communities normalize such abstractions more than others.

In short I believe languages that one can pick up in a couple of days and then read code where reasoning of the code is highly local would stand a higher chance of being perceived as simple.

Re:Maintain It with Zig by Jach on Wednesday September 08, 2021 @07:25PM (#28464296)
As always it depends. If you're thinking about preprocessor macros and operator overloading from C++, sure, those can be annoying, it's more to do with C++'s implementation and usage of them than the features themselves. You might want to try Common Lisp sometime; so much of the base language is made up of macros without which programs would be neither pleasant to read or write, and the language itself provides facilities to ask "ok but what function(s) are actually going to get called with this data" so that even not-so-local things like e.g. transparent logging of a call's input/output become visible if you need to know. But CL is not a language one can pick up in a couple of days -- albeit CL shops report success in getting new hires to be productive after a week or two of reading a book and the company code, which is a common onboarding time at many companies with any language.

Programmers notoriously conflate "simple" and "easy" (classic talk: https://www.infoq.com/presentations/Simple-Made-Easy/) and so I believe languages that are easy for a lot of programmers will also be perceived as simple, whether or not that's accurate.

Re:Maintain It with Zig by kaba0 on Thursday September 09, 2021 @05:44AM (#28467971)
Without powerful abstraction (of course used sparingly) you will just copy-paste the same logic in multiple places. Which is error prone and unmaintainable. And I would argue that even though a small part of it may be easier to read, you will have a harder time getting the big picture with low abstraction.
Re:Maintain It with Zig by Arnavion on Wednesday September 08, 2021 @03:39PM (#28462009)
Is

    char* c_foo(char* bar) { ... }
simpler than

    fn rust_foo<'a>(bar: &'a str) -> &'a str { ... }
?

On the one hand, c_foo is shorter and doesn't use strange symbols. On the other hand, rust_foo doesn't leave you guessing on whether the returned value needs to be free()d or not, and whether the heap allocation backing `bar` can be free()d after the call or not.

Re:Maintain It with Zig by steveklabnik on Wednesday September 08, 2021 @03:49PM (#28462124)
(You have a tiny typo; you forgot the <'a>. Also, I know you know this, but for those that don't, this signature could be written as

  fn rust_foo(a: &str) -> &str { ... }
but Arnavion is trying to be explicit here to make a steelman.)
Re:Maintain It with Zig by Arnavion on Wednesday September 08, 2021 @03:55PM (#28462227)
Yeah, I fixed that typo. And yes, foo is arbitrary, so one can assume it has another * / & parameter such that the lifetimes can't be elided any more.
Re:Maintain It with Zig by strokirk on Saturday September 11, 2021 @04:46PM (#28495805)
The first example is definitely simpler, yes.
Re:Maintain It with Zig by user-the-name on Wednesday September 08, 2021 @03:50PM (#28462149)
You are talking about the simplicity of a line of code. The topic being discussed, though, was the simplicity of the language itself.
Re:Maintain It with Zig by Arnavion on Wednesday September 08, 2021 @03:57PM (#28462254)
The simplicity of the language is directly correlated to the simplicity of that line. The fact that the language makes relationships between inputs and outputs explicit is a feature of the language, because of its borrow checker, at the expense of being syntactically verbose compared to C.
Re:Maintain It with Zig by user-the-name on Wednesday September 08, 2021 @05:35PM (#28463355)
Not at all. A single line will use a tiny subset of language features. It will show you nothing about the overall complexity of the language, just about those things it happens to use.
Re:Maintain It with Zig by paavohtl on Wednesday September 08, 2021 @02:11PM (#28460961)
In my experience unsafe tends to be used really sparingly by most users, if at all. And besides, unsafe doesn't really turn off static checks - it allows you to do a few extra things that can't be proven to be safe statically, in tightly scoped specially annotated regions. It's mostly about bending the rules temporarily, for 1-5 lines of code at a time.
Re:Maintain It with Zig by dimitrios1 on Wednesday September 08, 2021 @03:48PM (#28462122)
Side note: Nothing is provable in rust because it does not have a formal, verifiable specification. We have a reference implementation that we believe does the things it says it does on one particular architecture. But trust, not proofs, is indeed required. >:) (don't downvote murder me, I love rust)
Re:Maintain It with Zig by steveklabnik on Wednesday September 08, 2021 @03:54PM (#28462214)
A subset of Rust has been formalized and proven, but you're right that we're still working on it.
Re:Maintain It with Zig by heavyset_go on Wednesday September 08, 2021 @02:15PM (#28461023)
> It seems, from looking at others' code, that there is a very strong temptation to lean on `unsafe` instead of figuring out how to solve a problem within the constraints it normally applies.

Are you sure those examples of unsafe Rust code were written using unsafe in order to work around safety constraints due to difficulty?

I ask because there are some very real and valid use cases for unsafe code in Rust that have nothing to do with the fact that writing the code safely might be more difficult.

Re:Maintain It with Zig by mumblemumble on Wednesday September 08, 2021 @02:30PM (#28461209)
Not sure at all - I have effectively zero working knowledge of Rust - and certainly not looking to second-guess people's motivations for using the feature.

The big bias I'm working from here is that, as an outsider, I have a hard time reconciling all the big talk about how Rust makes it impossible to experience certain classes of bugs, with the existence of a known set of things that its type checker can't check, and which includes a lot of things that are difficult to avoid. One could be forgiven for thinking that the Rust community has a habit of keeping its fingers crossed behind its back when talking.

I don't want to make the perfect the enemy of the good, of course. I realize the feature is there for an important reason. But it sure looks to me like Zig is also good despite being imperfect. Perhaps they're both similarly good languages.

Re:Maintain It with Zig by not2b on Wednesday September 08, 2021 @03:06PM (#28461642)
Proper use of 'unsafe' in Rust is to write safe code that the compiler cannot prove is safe. In fact, this is done to implement many parts of Rust's standard library. See the split_at_mut example in

https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html

The spec here is to turn one mutable slice into two non-overlapping mutable slices. The operation does not violate memory safety; we wind up with only one mutable reference to any part of the object. But the compiler does not know how to verify that the programmer has done this correctly. Here, 'unsafe' means 'I certify that this is safe, use that as a lemma to do further checking'.

Re:Maintain It with Zig by pjmlp on Wednesday September 08, 2021 @03:35PM (#28461945)
All systems programming languages need the ability to do unsafe stuff, the big difference between C , C++, Objective-C and all the remaining system programming languages since JOVIAL and NEWP, is the explicit unsafe code blocks that make that visible.

It is a big difference to have it on your face that something might need to be properly double checked and having each line of code as possible security exploit.

Re:Maintain It with Zig by jhgb on Wednesday September 08, 2021 @04:44PM (#28462811)
> the big difference between C , C++, Objective-C and all the remaining system programming languages since JOVIAL and NEWP, is the explicit unsafe code blocks that make that visible.

Would you consider Oberon to belong in the former or latter category? On one hand, there's no explicit code blocks as such (syntactically). On the other hand, unsafe primitive operations are limited to the SYSTEM module, so functions calling operations in the SYSTEM module can be considered doing unsafe things.

Re:Maintain It with Zig by pjmlp on Wednesday September 08, 2021 @05:08PM (#28463089)
If you read Oberon documentation, modules importing SYSTEM are tainted and considered unsafe.

Just like Modula-2 already does it.

Re:Maintain It with Zig by jhgb on Wednesday September 08, 2021 @05:19PM (#28463204)
Well...that's what I meant. But which one is it, then?
Re:Maintain It with Zig by pjmlp on Thursday September 09, 2021 @02:06AM (#28466808)
Just like the languages that have unsafe code blocks it is relatively easy to track down unsafe modules, same thing.

And just like languages with unsafe code blocks, there are compilers that have switches to forbid the use of tainted modules unless explicitly allowed.

In any case, way better than what C, C++ and Objective-C offer, regarding security per line of code.

Re:Maintain It with Zig by Ar-Curunir on Wednesday September 08, 2021 @02:49PM (#28461453)
No type checker can catch all buggy programs (that involve solving the halting problem). In practice, Rust strikes a good balance: in over 120,000 LoC of Rust code that I have helped write and maintain, we have maybe 10 lines of unsafe, with performance matching or exceeding that of the C/C++ counterparts.
Re:Maintain It with Zig by tialaramex on Wednesday September 08, 2021 @08:51PM (#28464936)
> No type checker can catch all buggy programs (that involve solving the halting problem).

It's far worse than that, the problem is that the machine can't know what was intended. The result 5 from calling sum([1,2,1,1]) makes sense, but alas this function was intended to produce the product not the sum, the inputs were supposed to be [1,2,3,4] and the desired result was 24... the machine can't hope to guess that.

A program may be buggy even if it its meaning is transparent and exactly reflects its effect, simply because it doesn't reflect the intention of the person who wrote the wrong program.

This quote is attributed to Babbage:

'On two occasions I have been asked, – "Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?" ... I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question'

But that is what we wanted, even if we obviously can't have it.

Re:Maintain It with Zig by heavyset_go on Wednesday September 08, 2021 @03:44PM (#28462072)
It might help to better understand the motivations behind unsafe Rust by reading some of The Rustonomicon[1].

[1] https://doc.rust-lang.org/nomicon/