Hacker News Reader

Comment by quietbritishjim | Hacker News Reader

> There's only one systems-level/non-garbage collected language that provides rigorous memory safety. That's the Rust language.

Honest question: what about Ada? It was specifically designed to be a safe language for critical systems, and for a while was mandated for some military systems. Did the author not consider it, or are its protections just not as expansive as Rust's?

View on HN

I’m not the author, but there’s a few reasons Ada tends to be forgotten in these discussions:

Back when Ada was new, people just didn’t actually like programming in it much. Some did, of course, but many did not. This is the reason the Ada Mandate was abandoned.

This led into a situation with a small, walled off community that didn’t really communicate with the outside world much. This has a compounding effect over time.

Ada, while designed for safety critical systems, was not actually memory safe until fairly recently. Deallocating memory at runtime wasn’t, and in my understanding, may only be in the presence of SPARK? Hopefully someone can chime in here. Now, that fine for the systems Ada tended to be used for, which often have either no dynamic allocation or a singular allocation at program startup, but for inspiration for other language designs, given that it forgoes a hard problem, it’s not really as useful to those who are trying to solve those problems. This doesn’t mean Ada is useless for inspiration, but for “how do I implement memory safety,” it doesn’t have many unique uses things to offer.

None of this means Ada is a bad language, but these are the main contributing factors that I see with regards to your specific question.

That is the usual Ada outdated image, just like unsafe code blocks in Rust, those Unchecked Deallocation are wrapped in safe calls, and since Ada95 there are controlled types, allowing for RAII patterns.

Additionally, it is common to use arenas, and many types can be dynamically stack allocated with a retry operation in case there is not enough space, so that the call can be redone with a smaller size.

Memory Management with Ada 2012 from FOSDEM 2016,

https://archive.fosdem.org/2016/schedule/event/ada_memory/

Doesn't go much into SPARK related improvements though, given its date.

Rust's affine types and borrow checking give safe Rust a lot more power than the safe subset of Ada95. A trivial getter method that returns a reference (i.e. pointer) to a field of its object is safe in Rust, but in Ada95 (and C++ and most other non-GC languages) in general you can't ensure the object outlives the reference.

It is true that Ada has a safe suitable-for-systems-programming subset that's much better than most languages. I think when people say "Rust is the first safe systems programming language" they implicitly mean "that is expressive enough for me to replace C++ with".

Except we are into Ada 2022 nowadays, so SPARK is also part of the story.

How does "redo the call with a smaller size" possibly help you? If you could get by with less memory, you should have asked for less memory in the first place.

For some types of applications, it is a doable use case, it is the same as asking how malloc() returning NULL helps.

malloc() returning NULL isn't that helpful. Most applications just react to that by aborting, and most applications that don't abort take poorly-tested error-handling paths that often don't work. I don't remember ever seeing an application that reacted by trying the allocation again but requesting less memory.

I have seen applications react by pausing and trying the allocation again a few seconds later --- this can be shockingly effective! https://hacks.mozilla.org/2022/11/improving-firefox-stabilit...

Sure, none of that is particularly novel though, so in terms of citing it as something specifically to add to the conversation, there isn't any real reason.

It was the article author's choice to specifically say there is no safe systems programming language other than Rust. If that is not true then it's worth citing in discussion of the article.

My parent confirmed that deallocating memory is still unsafe, even though there are common usage patterns that help make sure you're doing it correctly.

Just like using double linked lists in Rust is unsafe, unless special libraries are used, this is no different.

Also we aren't talking about Ada83 any longer.

Ada itself doesn't provide you the same guarantees as Safe Rust. You can use SPARK to grant Ada more memory safety capabilities. However as a language (rather than comments which may or may not be ignored by your Ada compiler) SPARK is from 2014, so now we're close to Rust's age.

I assume that the totality of SPARK's guarantees would get you to the same place as Rust but I don't know.

A big thing which counts against Ada (and SPARK) in practice is that it's not popular. You'll trip over Rust programmers everywhere, two of my friends are getting paid to write Rust, for completely unrelated companies, unrelated reasons, Rust seems like a reasonable fit so those companies picked Rust. You don't see that with Ada and SPARK.

Rust gets the hype/talk. However there are a lot of Ada programmers out there who just do their 8 hours and go home and live their life. I doubt rust is anywhere near as popular as Ada, but I don't know how to measure that.

> I doubt rust is anywhere near as popular as Ada, but I don't know how to measure that.

I would have the reverse guess, but like you I can't think of a reliable way to get reliable numbers. Here's why I get my guess though: There just aren't that many defence IT people proportionally and only some of them are writing Ada. I saw no sign of non-defence Ada in noticeable quantities.

Sometimes people are just upfront, we're a defence contractor, all our clients are military, everybody who works here must get clearance. Sometimes they're a bit more shy, please come talk to our specialist recruiter, and fill out all these forms that are surprisingly interested in you as a person not an employee (because they're pre-screening you, you will get security cleared). Nobody was like "Ada has been so great for our CRUD web sites" or "Come join our team writing a trading platform in Ada" or anything like that.

So I think it just can't work statistically.

I think Ada not being very popular shows that the need for a memory safe non-garbage collected language is kind of overstated. If there was really that much of a need, people would have flocked to Ada despite its shortcomings.

Most people solved the safety problem a long time ago by switching to garbage collected languages. As times go on and garbage collector designs get better while hardware gets beefier you can get away with using a garbage collected language in more and more cases. Case in point golang marketing itself as a system programming language and succeeding, not to even mention even the game dev accepting C# these days.

To be clear, there is a niche and need for safe and non-garbadge collected languages and there will always be. I am just saying the niche is much smaller than people might think.

I think it is mistake for Rust evangelists to market safety of the killer-feature of the language. Rust is not popular because of the safety but because it lowered the barriers of entry for a new generation of system programmers by providing excellent tooling, error messages and a type system that take at least the lower hanging fruits of the academic functional world. That is all cool stuff beyond the safety circle jerk.

> I think Ada not being very popular shows that the need for a memory safe non-garbage collected language is kind of overstated.

It only shows that Ada is very old and verbose.

Reply on news.ycombinator.com