Announcing Arti, a pure-Rust Tor implementation (Tor blog)

Posted Jul 14, 2021 15:28 UTC (Wed) by peter-b (guest, #66996)
In reply to: Announcing Arti, a pure-Rust Tor implementation (Tor blog) by ncm
Parent article: Announcing Arti, a pure-Rust Tor implementation (Tor blog)

> But you can get equivalent safety by other means.

Hi, C++ standards committee member here.

You can't get "equivalent safety" in C++ to Rust "by other means", because the Rust programming language can express abstractions that C++ cannot, and because Rust has different and irreconcilable semantics with respect to references which are necessary for the compile time checks that the Rust compiler performs.

If the type of "correct by construction" programming model that Rust provides is appealing, then I recommend adopting Rust. Insisting that C++ has equivalent safety is silly, because it does not.

Announcing Arti, a pure-Rust Tor implementation (Tor blog)

Posted Jul 15, 2021 5:41 UTC (Thu) by ncm (guest, #165) [Link] (5 responses)

Yet, you can. The propaganda machine loves an underdog, but the great bulk of real work, by several orders of magnitude, is still done in C++, and will be for a long time to come.

C++ can express abstractions that Rust (still) cannot. But both languages are evolving rapidly.

Announcing Arti, a pure-Rust Tor implementation (Tor blog)

Posted Jul 15, 2021 6:21 UTC (Thu) by roc (subscriber, #30627) [Link] (1 responses)

If you're going to contradict a C++ standards committee member when making a claim about the capabilities of C++, you'd better have some evidence to back it up. So, how do you achieve equivalence to Rust memory and thread safety with C++? (Don't say ASAN or TSAN, because those tell you nothing about untested paths.)

ncm

Posted Jul 18, 2021 21:53 UTC (Sun) by tialaramex (subscriber, #21167) [Link]

It seems plausible that ncm is Nathan Myers, who was, and perhaps still is, an active JTC1/SC22/WG21 (ie C++ Standards Committee) participant. In which case what you've got there is two experts disagreeing.

But we are on the Internet, and so it is of course also possible ncm is a dog (I have verified that the committee member was not a dog).

In the former case, maybe we can say Nathan is trying to get C++ to a better place. After all, I think implicit constructors were a bad idea, they're the wrong default, but they're only a default at all because of the "explicit" keyword, which is apparently Nathan's idea. So once the situation was "C++ constructors are inexplicably dangerous" and Nathan improved it to "C++ constructors are inexplicably dangerous by default". The correct fix (an "implicit" keyword) violates C++ backwards compatibility promises and (which of more practical upshot) breaks a bunch of working code. So "explicit" means as long as every C++ programmer is conscientious and never makes a mistake they avoid this particular footgun. "Hooray".

Announcing Arti, a pure-Rust Tor implementation (Tor blog)

Posted Jul 15, 2021 13:42 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

> C++ can express abstractions that Rust (still) cannot.

The one I know of is "template template" parameters (basically higher kinded types). I suspect concepts can get one higher-ranked trait bounds as well, but I'm not sure about that. FWIW, both of these are being worked on.

On the other hand, C++ lacks useful destructuring (pattern matching is being worked on, but I don't see it being anywhere near as ergonomic), is stuck with terrible macro expansion rules, bad move semantics, and a blissful unawareness of lifetime analysis at the language (as opposed to the documentation/review) level.

I know which set *I* find more useful, but that's obviously not all that universal since there are many niches in the programming space.

Announcing Arti, a pure-Rust Tor implementation (Tor blog)

Posted Jul 15, 2021 17:11 UTC (Thu) by rgmoore (✭ supporter ✭, #75) [Link] (1 responses)

C++ can express abstractions that Rust (still) cannot.

This is trivially true, since one of the goals of Rust is to make it difficult or impossible to express some kinds of bugs. Greater expressivity is desirable only to the extent the things you're expressing are themselves desirable. Adding lots of foot guns makes the language more expressive, but in a way that's likely to make the final output worse rather than better.

Announcing Arti, a pure-Rust Tor implementation (Tor blog)

Posted Jul 16, 2021 22:30 UTC (Fri) by marcH (subscriber, #57642) [Link]

Exactly.

C++ is safe, you're just "holding it wrong". Well, too bad a couple lines of code "held wrong" are enough for a vulnerability or elusive concurrency crash.

Standard committee-level discussions matter, but how that translates into what happens in the trenches matters even more.