edit: Thank you to all of the repliers, I had no idea that most OSes were written in C. Er, actually, I'm more than well aware of that fact and I'm familiar with the number of CVEs that have occurred over the years because of the lack of memory safety involved in that C code.
Sorry, I simply don't get the appeal of writing more operating systems and network-exposed code that isn't written in a safer language. Say like Rust; see Redox.
However.
This is a microkernel. There is very, very little code inside a microkernel which, if written in Rust, would not end up inside an unsafe block. You are building the safe abstractions here; that code is inherently unsafe.
You could use Rust as a C replacement, but it is a worse C than C, and unsafe rust contains more perils (i.e. UB) than C.
It inherits from LK, which was written in C, but the new surfaces in the Magenta kernel are written in C++ (a restrained, limited C++, intended to take advantage of nice things C++ brings without getting us in too much trouble in the controlled kernel environment).
The core Magenta userspace drivers and services are mostly C at the moment, some will shift to C++ over time, and provided they use the same RPC protocols there's nothing preventing one from building such components in other languages once those other languages are building suitable binaries for Magenta.
That said, this is pretty much an open research question at this point, so you're right to be skeptical.
(I would also argue that unsafe Rust has more _unspecified_ behavior than C, but not more undefined behavior, but until we get those semantics truly nailed down, can't say for sure. See above "open research question" comment)
"Magenta has a capability-based security model. In LK all code is trusted."
Pony lang is a PL using capability-based concepts too.
> I don't think you could use Rust's safety features and get that size for the LK portion.
The point I attempted to make is that when you go small, and pare away what you used to create it, you could have used C and verified it with a certifier/prover. How does Rust address this goal? Truly curious, since I just started learning Rust. I program in C, not C++.
How does your example of the RTOS on the Cortex-M4 at ~30KB compare in complexity to LK at ~15KB in terms of what they deliver in that package size?
> How does Rust address this goal?
As for UB: Maybe it has less, but that which exists (e.g. noalias on mut refs) is very dangerous.
Like Steve said, the exact nature of this UB isn't completely specified yet (as in, when it actually is UB), so it is dangerous right now, but that's just temporary.
When Microsoft did their own new OS research project, Midori, that's the path they walked.
I do not get the impression that Fuchsia is a "research project", and it's purpose is not to advance the state of the art.
> When Microsoft did their own new OS research project, Midori, that's the path they walked.
How did it work out for them?
No doubt, and so are some art-house movies I've watched - they usually leave me thinking (or flummoxed).
There is a place for art-house movies and a place for more commercial fare (e.g. blockbusters) - it is important not to confuse the two.Some gifted auteurs manage to blend the two, but IMO,it is wrong for anyone to say "if you're taking the time to make a movie, make it intellectual"