back

by Rochus·6y ago·view on hn ↗
There is no reason to assume it is the "Best Chance". There are a lot of other chances too, some even since more than two decades (e.g. Ada/Spark). Even C++ itself has not yet shot all the powder. And just as one can write secure code in C++, it will turn out in time that even with Rust not everything is as secure as propaganda would have you believe.

I would be interested to know if this is really the official opinion of Microsoft, or if someone just wants to make a name for himself.

7 comments
Having a minimal runtime is, I believe, a requirement to make any serious headway into a lot C/C++ use cases. The places where minimal runtime is not important have already seen big shifts to garbage-collected languages ~20 years ago.

You mentioned Ada, which does have a minimal runtime. It might be interesting if the community and ecosystem made a strong push into general-purpose programming, like rust has. I would give it another try.

Rust seems to handle heap allocations more fluidly (or at least closer to what I expect), but perhaps that wouldn't be a deal-breaker if I knew more about progamming in Ada. Rust also has better C integration -- it can match C structure layouts and operate on them seamlessly with rust semantics. But basically, it seems plausible that Ada could work with the right ecosystem around it.

Regardless, Ada has had decades to make the leap into general-purpose programming, and it hasn't done so yet. Rust is viable today for a lot of important use cases, and is not far off for a lot of others.

I don’t understand your argument. Ada, C, C++, D, Fortran... and other old languages can be used right away for general-purpose applications.

Swift, Zig, Rust, Go, etc. are popular because there has been a resurgence of new languages in recent years and a lot of new, young developers are helping develop libraries for them.

It is simply not as fashionable to program in old languages so some new developers don’t.

The article's thesis: "Microsoft has deemed C++ no longer acceptable...needs to move...best choice on the market today is rust".

If moving away from C/C++ to something, C and C++ are out of the running. You can claim that they should still be considered, but they've been around a long time and people have tried very hard to make them safer. There's been some success, but there's not a lot of evidence that real C/C++ codebases will become dramatically safer in the next 5 years. It looks like some people are looking pretty hard at alternatives.

Ada and fortran are both older than C++, so it is not clear that there ever was or ever will be a lot of net movement from C++ to either of those unless something exciting happens. It would be cool if Ada did get more appealing for C++ migrations, but I just don't see it happening.

That leaves D and Rust. Apparently a lot of people think rust has the mix of excitement, community, and technology to make it happen. We don't know for sure, but it seems like a reasonable bet to make if you are trying to dislodge C++ due to frustrations about memory safety.

I think the fact that Rust is very popular in the polls, but still hardly ever used, rather indicates that people primarily want to escape from their current dissatisfaction, but then ultimately don't take it seriously with switching to another technology, so as with Ada or others already available. Besides, C++ is also evolving, and formal verification has been possible for many years. There are also proven ways to avoid memory problems. Rust would have to prove itself first. Maybe it solves one problem better, but ten others worse.
The thesis of the article was "best chance". So if not rust, then what? C++ and Ada have lots of great possibilities, but those possibilities aren't making it into practice (for whatever reason) despite a lot of time and effort.

Apparently, the author thinks that rust might make that leap sooner than Ada/C++. It seems like a reasonable guess, and with some backing by major players, it might well happen.

Sure, there's a lot of uncertainty while we are waiting to see the results from a diverse set of large projects. I have used rust enough to be annoyed by it, but none of the annoyances seemed like a major blocker to rust's future.

> but those possibilities aren't making it into practice (for whatever reason) despite a lot of time and effort.

What do you mean? Ada is used routinely in some industries.

By "possibilities", I mean the possibility as an alternative to (or major safety improvement on) C++, which is what the article is talking about: "Microsoft has deemed C++ no longer acceptable...needs to move...best choice on the market today is Rust".

Ada is a possibility, but it's just not there and does not show signs of being there soon. There's probably not a net movement from C++ to Ada today, and there is no reason to expect differently over the next 5 years.

Rust is not a sure bet either. Lack of major real systems is a big question mark. But basically the article's thesis makes sense to me.

> I think the fact that Rust is very popular in the polls, but still hardly ever used

In what sort of polls is Rust's popularity overrepresented (when compared to industry usage)? A lot of people on Internet forums like Rust, but a lot of people on Internet forums like a lot of languages, especially new ones.

And what is your definition of "hardly ever used"? I can think of plenty of programs I use frequently that make use of Rust (e.g. Firefox). Compare the use of Rust to, for example, Racket or Haskell or Julia (all fine language). I've definitely interacted with programs written in Rust far more than any of those three languages. So at least Rust is seeing some niche usage.

Not trying to come to Rust's defense, just trying to understand this point.

"Hardly ever used" sounds like it might be the result of your personal filter bubble?
see https://insights.stackoverflow.com/survey/2019

Only a small fraction of "Rust fans" are actually using it.

I wonder what percentage of folks (not exclusive to Rust lovers) are stuck with a language at work or in major side projects because of momentum, existing code bases/etc.
I don't think it's just a filter bubble. Look at any programming jobs site. Count how many listings you see for Rust versus any language you'd consider commonly used.
We were not specifically talking about present availability of jobs. I am personally aware of many projects being done in Rust and from my experience, it seems to be growing still.
It might also indicate that a lot of the projects that Rust would be a great fit for tend to live for a long, long, time. That slows down market penetration, regardless of how much better it is.
I wonder if maybe Ada/Spark could achieve a resurgence with a Reason-style syntax modernization. A lot of people are repelled by the word-heaviness of Algol/Pascal-style BEGIN/END.
Momentum counts, and Ada/Spark have little mindshare right now. If next to nobody ever adopted them in the last two decades unless mandated by requirements, what chance do they have for the near future? For whatever reason, Rust is surging in popularity and is currently the most promising bet for memory safety to become commonplace in the system programming circles.
Rust is the new utopia; at the moment there is only the (founded) assumption that you write more secure software with it. Only time will tell whether this is actually the case and whether the same number of security problems will be displayed in Rust applications in ten years' time. But as is well known, hope is nourished by promises of salvation.
The problem with this attitude is:

* The claims aren't baseless. We've seen for decades already that memory safe languages have fewer memory safety issues than languages that are not memory safe.

* Asking for hard proof is silly in software. There's tons of research into programming languages and their impact on software projects, across a number of areas, and it's all fairly useless - it's extremely expensive to do right, and impossible to objectively measure.

Common sense isn't propaganda.

> that memory safe languages have fewer memory safety issues than languages

That's what I would assume ;-)

By the end of the day it's also a question of performance. For embedded, realtime or mobile core technologies there will always be a need to shortcut.

> Asking for hard proof is silly in software.

Not only in software. That's what the scientific method is for. That needs time. Currently there is a debate whether the switch from Ada to C++ for the F-35 is the cause of all the observed problems and budget overruns. There is still not enough data to know. But there was a decade-long track record for Ada in avionics. And C++ also had to establish itself for twenty years before anyone dared to develop an F-35 with it.

> Asking for hard proof is silly in software.

You can however prove that the language solves a particular attack ;)

Do you have a reference where this has been done with Ada/Spark?
There's a second story to Rust appeal: not just systems people hoping to gain safety rails previously only enjoyed by high-level programmers, but also applications programmers hoping to gain some low-level capability without losing safety rails. The former is far more important, but the latter is driving much of the public love for Rust (there simply aren't that many systems programmers out there)
People seem to want a language that gives you similar memory handling to C++, which Ada doesn't really do. In any case, developers don't seem to be too keen on adopting Ada.

> And just as one can write secure code in C++, it will turn out in time that even with Rust not everything is as secure as propaganda would have you believe.

I think the point is more that Rust is memory safe by default, and you have to opt out of it. In C++ on the other hand, memory safety basically falls to the developer, with plenty of crazy pitfalls to watch out for in the language. It's not that it can't be done, it's just harder to do it right. Rust makes the easy, default thing safe, and the unsafe thing requires extra effort.

> In any case, developers don't seem to be too keen on adopting Ada.

Yes, unfortunately; the trend seems to go in the opposite direction; but anyway: if I really wanted to switch to something new and spend the effort to invest in new tools and education, then I would rather choose a technology with a decently long track record demonstrating that it fulfills all my expectations because of which I left my original technology. Rust will take one or two decades for this; Ada/Spark has already been through this.

If everyone adopted this mindset, there'd be no new programming languages because no one would learn them until they'd been around for 20 years. Sometimes it makes sense for companies to take a risk on a new technology.
If it's your company and your money, then of course you can decide yourself whether you want to take that risk; most likely not immediately in a multi-million dollar project though.
To be fair, rust is a good systems programming language, for scenarios where correctness is important and runtime footprint must be small. I have no problems with it promoted as a good systems programming language. It seems much more modern than Ada or something and may lend itself better to formal verification.

What I hate is rust fanboys' propaganda that rust is great for every purpose including CRUD stuff because crab god moral and borrow checker is moral responsibility. There is lot of dishonest marketing sounding like rust doesn't have cognitive overhead compared to other languages. It gives me an impression that, in best case, it is selection bias among people that successfully learn and use rust, or in worst case, some people trying to show off that they learned a 'hard' language and it is 'easy' for them.

Secondly rust community is very political and polarising that many people don't like. It almost seems full of non-STEM-worthy people although they are a vocal minority..

IMO Rust's cognitive cost is paid upfront. Other popular languages shove that cognitive cost as technical debt into the future.

An example from a while back: needing to rewrite your whole original Ruby code base in Scala. Or having to write your own PHP compiler.

Can you elaborate on the "propaganda" comment?
Rust users have a reputation for being eager to promote their language. There's a running joke of a "Rust Evangelism Strike Force" that roams the internet looking for places to "Rewrite it in Rust" and this is, in my experience, at least partially true.
The rust evangelism strike force seems to be matched only by the rust criticism strike force - the rub of it is that once these things get started they seem to be pretty much self-sustaining, with every Rust discussion immediately attracting two large groups, each of which are only there to argue with the other. Overall it makes everyone look bad, but certainly has the impact of making it more difficult to find reasoned discussion around Rust's advantages and shortcomings.

There is a similar phenomena around Microsoft, with nearly every news item about them attracting two such camps, so this news item happens to find itself at a rather unhappy intersection!

For what it's worth, as someone who's working on a first project in Rust right now, the actual Rust documentation and direct Rust community seem to be friendly and helpful. It's only in more 'neutral' discussion forums like here where most things about Rust devolve into trench warfare. I also feel that, subjectively, the core Rust communities (e.g. the rust-lang forums) are pretty honest about identifying places where Rust or its tooling currently fall short (plenty of "I don't know that there's a good way to do this right now.").

Attract people with promises based on unwarranted denigration of other technologies. They should present appropriate, independent studies instead, not just claim something. In the article itself you can read that even Microsoft with its billions of lines of C++ code will certainly never switch to Rust. And in C++ 23 something similar to what is not even thought through in Rust today is also planned.
> And in C++ 23 something similar to what is not even thought through in Rust today is also planned.

Source? The closest thing in C++ to what Rust offers today is the C++ Core Guidelines https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines but these are best-effort in nature and do not have a goal of comprehensively ensuring soundness or memory-safety.

And I'm not sure why you're implyng that the Rust featureset "isn't even thought through" when the Rust Belt project has been doing a lot of work on modeling it in a principled and clearly-understandable way, and this has already contributed usefully to the design of newer Rust features.

There are a lot of mechanisms in C++ to avoid the issue Rust want's to solve with the borrow checker altogether. And there are proposals going in the same direction as the borrow checker. But in the end, human error can somehow circumvent all these security mechanisms, no matter how much hoopla they are praised today.
> And in C++ 23 something similar to what is not even thought through in Rust today is also planned.

I'll believe it when I see it. The C++ committee consistently fails to deliver on safety features.

Are there good examples of people replacing C++ code with Ada and Spark?
Unfortunately not that many; I also don't believe that all the exited folks will really switch to Rust. Maybe this one is interesting for you: https://blogs.nvidia.com/blog/2019/02/05/adacore-secure-auto...
Ada doesn't have a borrow checker.
Why should it need one?
To support freeing heap allocations in a memory-safe way without relying on a GC.
Looks like that is effectively a borrow checker. So, the reason to need one still seems valid.