Hacker News Reader

Comment by steveklabnik | Hacker News Reader

I wrote up a blog post about it, I linked to it in a sibling comment, I don't want to spam :)

> So what's the argument here? That the C++ code might be safe to call that way if we're lucky?

No, the argument is that we've checked that the C++ code is safe to call, just like any other FFI. We've reduced the boilerplate of doing so with a macro, just like any other boilerplate might be.

> I definitely don't want a FFI library to tag functions as safe for me before I had the time to validate it,

Do you validate every single unsafe code in every single library you use? Even the standard library? Every time?

> And I definitely don't want a third-party crate to expose a safe-but-unsound Rust interface with a big disclaimer that "basically it's just raw calls to C++, make sure you use it right otherwise it's segfault time!".

I do not either, but CXX doesn't change this in any meaningful way. This could still happen before.

View on HN

> Do you validate every single unsafe code in every single library you use? Even the standard library? Every time?

We don't need to? Rust's main soundness theorem says that if a safe Rust API is sound, then safe Rust code using it is sound.

So the only thing we need to check is that the unsafe code that _we_ write is sound, and we 100% do this all the way for the standard library. In the standard library _every_ unsafe block has a comment explaining why the "user-provided soundness proof" that they represent is correct. We even have a linter that actually rejects PRs that add unsafe blocks to the standard library without such comments.

> Do you validate every single unsafe code in every single library you use? Even the standard library? Every time?

Soundness is IMO Rust's main feature and its main core value, and is more important than other Rust core values like, e.g., zero-overhead abstractions, which are also extremely important. Soundness is what enables "Hack without fear", "no segfaults", "refactor without fear", cargo ("large scale software without fear"), crates.io ("using other people's libraries without fear")... and it's what sets Rust apart from unsound-by-design languages like D, Nim, Zig, C, C++, etc.

I haven't read the book in a long time, but the documentation I do read (nomicon, spec, unsafe code guidelines, issue tracker, internals) makes it very clear that making sure that unsafe Rust code is correct is critical for the ecosystem and for users to benefit from the main advantages Rust has to offer.

> Do you validate every single unsafe code in every single library you use? Even the standard library? Every time?

Nope. But if I use a rust library, the compiler will do that for me. If it's Rust. And not CXX.

I shouldn't have to in Rust. That's... the central premise here. Usage of unsafe code should say that it's unsafe.

Reply on news.ycombinator.com