Is Rust Used Safely by Software Developers?.
Rust, an emerging programming language with explosive growth, provides a
robust type system that enables programmers to write memory-safe and data-race
free code. To allow access to a machine’s hardware and to support low-level
performance optimizations, a second language, Unsafe Rust, is embedded in Rust.
It contains support for operations that are difficult to statically check, such
as C-style pointers for access to arbitrary memory locations and mutable global
variables. When a program uses these features, the compiler is unable to
statically guarantee the safety properties Rust promotes. In this work, we
perform a large-scale empirical study to explore how software developers are
using Unsafe Rust in real-world Rust libraries and applications. Our results
indicate that software engineers use the keyword unsafe in less than 30% of
Rust libraries, but more than half cannot be entirely statically checked by the
Rust compiler because of Unsafe Rust hidden somewhere in a library’s call
chain. We conclude that although the use of the keyword unsafe is limited, the
propagation of unsafeness offers a challenge to the claim of Rust as a
memory-safe language. Furthermore, we recommend changes to the Rust compiler
and to the central Rust repository’s interface to help Rust software developers
be aware of when their Rust code is unsafe.
Read in full here:
This thread was posted by one of our members via one of our news source trackers.
I can’t imagine how reading books about Rust will help you a lot. There’s a metric ton of excellent practices for commercial project work that are rarely mentioned in theoretical guides. There are good tutorials out there that recommend de facto standards (namely widely liked libraries plus language idioms that go well with them) and IMO many books would skip over these, making you learn Rust’s core constructs instead – and there are many of them.
I am not saying the books aren’t good. Actually the official e-books (on websites) are of an amazing quality. But be advised – it’s a lot of material either way.
Rust absolutely isn’t something that you will learn well over a course of a month, even. Very likely to be a 5-6 months worth of journey indeed.
I have to tell you that most Rust devs I’ve known couldn’t care less about web dev. To them this falls into the category of “nice to have”… in the best case scenario.
Most would react with something like “those damn web hippies better stay away from our good system language”. Not a productive mindset, yep.
Mind you, Rust is uniquely positioned to severely disrupt many web dev areas, Elixir/Phoenix included – and with Rust’s closer and closer friendship with WASM they just might.
But they deem web dev an easy problem and believe me, after seeing what some of them are working on, I agree.
For now normal web development is “allowed” to exist. Simply because the truly hardcore dev communities like Rust / OCaml are busy with a lot bigger and harder stuff.
All of that being said, do search for a good tutorial on actix_web, version 3.0 and above. This web framework saturates 10Gbps link with 10,000 concurrent requests happening at the same time.
There is a book from newline.co called Fullstack Rust, which teaches actix as well as WebAssembly in rust.
One more thing: I’ve seen the creator Nikolay Kim and other core contributors of actix, fighting over the usage of unsafe. Nikolay was striving for the fastest thing possible, and others were striving for the safest one.
Nikolay Kim left the project and started another library/framework called ntex. Rest of the team replaced almost all the unsafe code with safe code. And the good thing is that actix is still as fast as ntex.
I was following closely their long discussions (actually fights) on Github and other places, because I was and am highly interested in this project. And yes, thankfully actix isn’t as unsafe as it was, but is still as fast as it was.
Like automatically editing code, e.g. you use a certain framework and you could issue commands like “add a POST endpoint with these or that parameters”.
But that’s just scratching the surface. The Rust, Haskell and OCaml communities seem to work on high level math problems of proving that your program cannot have this or that state which is super important in the age of so many software vulnerabilities.
But your question made me realize that I’ve only been accumulating impressions and not actually writing down the amazing innovative ideas (and libraries / language features in progress) that I’ve seen in the last year or so. I’ll do better on that and write each and every one of them the next time I stumble upon any.
It’s pretty trivial to pickup if you already know C++ and something functional like OCaml or Haskell, it uses concepts from both so I picked up it fairly instantly, after that it was just acclimating to its setup of things (which is awesome compared to both C++ and OCaml/Haskell by a wide margin, lol).
However, it is big like C++ and OCaml/Haskell, so if you don’t know them it’s basically like learning a large subset of them, hence its size.
It is a lot easier to jump in to in a lot of ways thanks to its awesome compiler helping you though.
You would be surprised at how HUGE the webdev community is in rust, both for making backend servers and for making frontend wasm UI’s and everything in between.
There’s a reason that Rust is the most used wasm language after all, lol.
Personally I’ve been using Rocket for the backend side and mogwai for the frontend side. ^.^
I likely would be but then again last year I’ve worked in a corporation where one of the big frameworks’ contributors also worked – I know how passionate the Rust people are in general, it’s just that most Rust devs have to do so much that when they get to web work they breathe a sigh of relief, lol.
Like, this guy (Rob something, can’t remember now) just casually rewrote a whole web backend with 50+ endpoints from rocket 0.4 to actix_web in a day… A PR with something like 600 additions and 450 deletions or some such. I was seriously very impressed.
But in any case, I am not arguing that the Rust community does not care about web – they do. It’s just my observation that many don’t and that the web sub-community is small and very passionate (and hardcore).
Simply because the truly hardcore dev communities like Rust / OCaml are busy with a lot bigger and harder stuff.
