Wedson Almeida Filho is a Microsoft engineer who has been prolific in his contributions to the Rust for the Linux kernel code over the past several years. Wedson has worked on many Rust Linux kernel features and even did a experimental EXT2 file-system driver port to Rust. But he's had enough and is now stepping away from the Rust for Linux efforts.
I am retiring from the project. After almost 4 years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them.
...
I truly believe the future of kernels is with memory-safe languages. I am no visionary but if Linux doesn't internalize this, I'm afraid some other kernel will do to it what it did to Unix.
Lastly, I'll leave a small, 3min 30s, sample for context here: https://youtu.be/WiPp9YEBV0Q?t=1529 -- and to reiterate, no one is trying force anyone else to learn Rust nor prevent refactorings of C code."
The kernel is mostly written in C, by C developers... understandably they're rather refactor C code to make it better instead of rewritting everything in the current fancy language that'll save the world this time (especially considering proponents of said language always, at every chance they get, sell it as C is crap, this is better).
Linux is over 30yo and keeps getting better and more stable, that's the power of open-source.
From other discussions I've seen, the guy stepping down was frustrated by having C code rejected that made lifetime guarantees more explicit. No rust involved. The patch was in service of rust bindings, but there was 0 rust code being reviewed by maintainers.
This sounds exactly like the type of nontechnical nonsense they're complaining about: attacking a strawman ("they're trying to prevent people from refactoring C code and making them rewrite everything in the current fancy language") even after explicitly calling out that that was not going to happen ("and to reiterate, no one is trying force anyone else to learn Rust nor prevent refactorings of C code").
Better in what ways? Rust's strong points are not to just make a program more stable, but more secure from a memory standpoint and I don't think Linux keeps improving on that
No idea what you’re being downvoted. Just take a look at all the critical CVSS scored vulnerabilities in the Linux kernel over the past decade. They’re all overwhelmingly due to pitfalls of the C language - they’re rarely architectural issues but instead because some extra fluff wasn’t added to double check the size of an int or a struct etc resulting in memory corruption. Use after frees, out of bounds reads, etc.
These are pretty much wiped out entirely by Rust and caught at compile time (or at runtime with a panic).
The cognitive load of writing safe C, and the volume of extra code it requires, is the problem of C.
You can write safe C, if you know what you’re doing (but as shown by the volume of vulns, even the world’s best C programmers still make slip ups).
Rust forces safe(r) code without any of the cognitive load of C and without having to go out of your way to learn it and religiously implement it.
They're being downvoted because it's a silly comment that is basically unrelated and also extremely unhelpful. Everyone can agree that C has footguns and isn't memory safe, but writing a kernel isn't memory safe. A kernel written in Rust will have tons of unsafe, just look at Redox: https://github.com/search?q=repo%3Aredox-os%2Fkernel unsafe&type=code That doesn't mean it isn't safer, even in kernel space, but the issues with introducing Rust into the kernel, which is already written in C and a massive project, are more nuanced than "C bad". The religious "C bad" and "C good" arguments are kinda exactly the issue on display in the OP.
I say this as someone who writes mostly Rust instead of C and is in favor of Rust in the kernel.
I agree and think that should be helpful, but I hesitate to say how much easier that actually makes writing sound unsafe code. I'd think most experienced C developers also implicitly know when they're doing unsafe things, with or without an unsafe block in the language -- although I think the explicit unsafe should likely help code reviewers and tired developers.
It is possible to write highly unsafe code in Rust while each individual unsafe block appears sound. As a simple example: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=6a1428d9cae5b9343b464709573648b4 [1] Run that on Debug and Release builds. Notice the output is different? Don't take that example as some sort of difficult case, you wouldn't write this code, but the concepts in it are a bit worrisome. That code is a silly example, but each individual unsafe block appears sound when trying to reason only within the block. There is unsafe behavior happening outside of the unsafe blocks (the do_some_things function should raise eyebrows), and the function we ultimately end up in has no idea something unsafe has happened.
Unsafe code in Rust is not easy, and to some extent it breaks abstractions (maybe pointers in general break abstractions to some extent?). noaliases in that playground code rightly assumes you can't have a &ref and &mut ref to the same thing, that's undefined behavior in Rust. Yet to understand the cause of that bug you have to look at all function calls on the way, just as you would have to in C, and one of the biggest issues in the code exists outside of an unsafe block.
[1]: If you don't want to click that link or it breaks, here is the code:
fn uhoh() {
let val = 9;
let val_ptr: *const usize = &val;
do_some_things(val_ptr);
println!("{}", val);
}
fn do_some_things(val: *const usize) {
let valref = unsafe { val.as_ref().unwrap() };
let mut_ptr: *mut usize = val as *mut usize;
do_some_other_things(mut_ptr, valref);
}
fn do_some_other_things(val: *mut usize, normalref: &usize) {
let mutref = unsafe { val.as_mut().unwrap() };
noaliases(normalref, mutref);
}
fn noaliases(input: &usize, output: &mut usize) {
if *input < 10 {
*output = 15;
}
if *input > 10 {
*output = 5;
}
}
fn main() {
uhoh();
}
I honestly like the cognitive load. Just not when I am at the workplace, having to deal with said load, with the office banter in the background and (not so) occasionally, being interrupted for other stuff.
And my cognitive load is not even about the memory allocations, most of the time.
Off topic:
I think, if one is seriously learning programming from a young age, it is better to start with C, make a project, big enough to feel the difficulty and understand what the cognitive load is all about and get used to it, hence increasing their mental capability. Then learn the memory safe language of their choice.
I never made a big enough project in C, but you can get to feel the load in C++ too.
I’m not insisting anything; stating C is not a memory-safe language isn’t a subjective opinion.
Note I’m not even a Rust fan; I still prefer C because it’s what I know. But the kernel isn’t written by a bunch of Lewis Hamiltons; so many patches are from one-time contributors and the kernel continues to get inundated with memory safety bugs that no amount of infrastructure, testing, code review, etc is catching. Linux is written by monkeys with a few Hamiltons doing their best to review everything before merging.
Linus has talked about this repeatedly over the past few years at numerous conferences and there’s a reason he’s integrating Rust drivers and subsystems (and not asking them to fork as you are suggesting) to stop the kernel stagnating and to begin to address the issues like one-off patches that aren’t maintained by their original author and to start squashing the volume of memory corruption bugs that are causing 2/3rds of the kernel’s vulnerabilities.
Yeah, let's see what Bagder has to say about this:
C is unsafe and always will be
The C programming language is not memory-safe. Among the 150 reported curl CVEs, we have determined that 61 of them are “C mistakes”. Problems that most likely would not have happened had we used a memory-safe language. 40.6% of the vulnerabilities in curl reported so far could have been avoided by using another language.
Rust is virtually the only memory-safe language that is starting to become viable.
Yes a monkey. All the vulnerabilities that have happened over the decades are just bad c programmers. So the question is are there any good c programmers?
It's not just about bad/good C programmers.
It's also about how much of the context, the given C programmer has read to make sure they know enough of what they are doing.
No matter how good one is at Programming, they need to make sure to read and remember what is happening in relevant parts of code, while making their one off contribution.
That's where the part of "leaving it to the computer" comes in. Hence, the usefulness of code checkers and even better if the compiler itself enforces the stuff. As long as the rules are good enough.
Let's just hope we are not jumping to another language 20 years down the line.
C isn't even bad, as long as you use the minimum amount required and do a LOT of security analysis on every line you write.
The problem with C code isn't necessarily the language, a lot of it is the culture of people who think that unlike everyone else, they can write good, secure, bug-free C code, and they can ignore the warnings. They're just that good!
These people seem to take the mere concept of a language that enforces memory access or security features as an insult to their intelligence.
Because of this bullshit, Linux is now behind in terms of Rust take up as Windows has begun rewriting components into Rust. I wouldn't be surprised if the ego-based in-fighting between kernel devs will lead to Windows being significantly more secure in a few years.
Agree. I'm an absolutely awesome software dev myself - and I know C by heart (being my favorite language after assembler). However, with age comes humility and the ability to recognize that I will write buggy code every now and then.
Better the language saves me when I can't, in security critical situations.
Even if you manage to keep all memory accesses in your memory, while writing the code, there's a good chance you'll forget something when reviewing another person's MR.
That's probably the main problem creator.
Still, a language that you are familiar with, is better than a new language that you haven't finished reading the specifications of. And considering that adding new maintainers comes with a major effort of verifying trustworthiness, I get how it would be harder to switch.
I think most people would agree with you, but that isn't really the issue. Rather the question is where the threshold for rewriting in Rust vs maintaining in C lies. Rewriting in any language is costly and error-prone, so at what point do the benefits outweigh that cost and risk? For a legacy, battle-tested codebase (possibly one of the most widely tested codebases out there), the benefit is probably on the lower side.
Hmm... I admit I didn't follow the video and who was speaking very well and didn't notice hostility that others seem to pick up on. I've worked with plenty of people who turn childish when a technical discussion doesn't go their way, and I've had the luxury of mostly ignoring them, I guess.
It sounded like he was asking for deeper specification than others were willing or able to provide. That's a constant stalemate in software development. He's right to push for better specs, but if there aren't any then they have to work with what they've got.
My first response here was responding to the direct comparison of languages, which is kind of apples and oranges in this context, and I guess the languages involved aren't even really the issue.
Part of the hostility was the other maintainer misunderstanding the presenter, going on a diatribe about how the kernel Rust maintainers are going to force the C code to become unrefactorable and stagnate, and rudely interrupting the presenter with another tangent whenever he (the presenter) tried to clarify anything.
An unpleasant mix of DM railroading and gish galloping, essentially.
I wouldn't quite call it a strawman, but the guy was clearly not engaging in good faith. He made up hypothetical scenarios that nobody asked about, and then denigrated Rust by attacking the scenarios he came up with.
Edit: I was thinking of the wrong fallacy. It is a strawman, yes.
Seeing as how 40% of the security issues that have been found over the years wouldn't exist in a memory-safe language, I would say a re-write is extremely worth it.
Maybe when you build some little application or whatever. When building the most used kernel in the world, there are probably some considerations that very few people can even try to understand.
Lots of categories which Rust doesn't prevent, and in the kernel you'll end up with a lot of unsafe Rust, so it can't guarantee memory-safety in all cases.
The biggest items on the graph are all out of bounds accesses, use-after-free and overflows. It is undeniable that memory safe languages help reducing vulnerabilities, we know for decades that memory corruption vulnerabilities are both the most common and the most severe in programs written in memory-unsafe languages.
Unsafe rust is also not turning off every safety feature, and it's much better to have clear highlighted and isolated parts of code that are unsafe, which can be more easily reviewed and tested, compared to everything suffering from those problems.
I don't think there is debate here, rewriting is a huge effort, but the fact that using C is prone to memory corruption vulnerabilities and memory-safe languages are better from that regard is a fact.
My gut feeling is you didn't hook a programmer but a debate pervert (maybe shouldn't have dropped the D word lol). Some people hear that word and turn they minds off cuz debates are simply a game for them to win. I'd just let this one swim brother
Yea, it's not C that is crap, but that it has zero guard rails. Like blaming a knife for not having a guard... Is it a bad knife without a guard? Depends on how sharp it is. The guard is orthogonal to the knife's purpose, but might still be important when the knife is used.
Just because something doesn't help prevent accidents does not mean it cannot serve its actual purpose well, unless its actual purpose is safety.