|
|
Subscribe / Log in / New account

Bjarne Stroustrup’s Plan for Bringing Safety to C++ (The New Stack)

Bjarne Stroustrup’s Plan for Bringing Safety to C++ (The New Stack)

Posted Oct 31, 2023 9:44 UTC (Tue) by tialaramex (subscriber, #21167)
In reply to: Bjarne Stroustrup’s Plan for Bringing Safety to C++ (The New Stack) by mb
Parent article: Bjarne Stroustrup’s Plan for Bringing Safety to C++ (The New Stack)

Firstly, no, you aren't restricted to single threaded. Rust's rule would work fine globally, you couldn't build a systems language which requires this rule globally and yet we can write bit-banging micro-controller code and kernel drivers - however you could build a perfectly nice language capable of multi-threading and indeed that's closer to what Graydon Hoare (who invented Rust) originally wanted.

Also, data races don't even necessarily lead to UB. They are specified as UB in C and C++ and (though as stated safe Rust doesn't have any) in Rust, but in Java a data race isn't Undefined Behaviour. Your program continues to be well-defined, but since it loses Sequential Consistency humans struggle to understand what the residual behaviour means. Still, it does have meaning still. If you cared a dedicated team could likely eventually figure out what your program does now.

In OCaml they have further refined this, to the extent that they hope (it's early days) OCaml with data races is not only still well-defined, humans should be able to successfully reason about how the resulting software behaves. This is PL research level work, but it's easily possible that in twenty years "My programming language has Undefined Behaviour when there are data races" marks you as a caveman as much as "My programming language has Undefined Behaviour for integer overflow" does today.

The important cultural difference (and culture is key here, that's what's so hilarious about the reaction from C++ and from WG21 specifically, they don't see what the real problem is and so they're not even addressing it) is that code marked "unsafe" in Rust is culturally expected to satisfy safety constraints, but it's allowed to demand pre-conditions of its callers. That's what SAFETY block comments are in Rust code if you've seen those. They're explaining either why this code is actually fine despite using unsafe keyword, or, how to correctly use this unsafe function so as to deliver safety.

Rust's community shuns people, libraries, codebases which YOLO the way C++ does. Technically nothing prevents you writing much the same dangerous nonsense. Culturally it's prohibited. That's not something WG21 could fix by tweaking the text of their ISO document, Rust has a safety culture, C++ does not, if safety is important (and I would argue it is) that's what actually matters.


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds