Rust Programming Language Air Mozilla, 3 Jan 2017

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Josh Matthews - An Introduction To Rust

Description

As part of our Engineering Onboarding program, Josh Matthews takes us through a quick introduction to the Rust programming language.

Help us caption & translate this video!

http://amara.org/v/2FiI/

A

--People are not important, --.

A

--There are no people in technology,, just replaceable components, --.

A

B

Alright, let's do this.

A

Alright,, I'm going to tell you about what rust is,.

A

Why rust is a part of mozilla's work.

A

And when it's going to start being a part of mozilla's work.,.

A

Let's begin. so rust is a new programming language that has been created inside mozilla.

A

And shared with the outside world., the goal of it is basically anytime when you traditionally, as a developer, have reached for c++, because you needed certain guarantees about performance. For example,.

A

We want rust to be a viable alternative in every single case.. There should be no reason to choose c++ over rust in the ideal future.

A

So it began as a side project of a mozillian named graydon hoare back in before 2009..

A

He started working on it full-time in 2009, because mozilla saw the ideas that he had and said.

A

"We can see how we could put this into firefox...

A

...and make the product better. If we actually had this language".

A

So that's when we started investing time and resources into it.

A

Fast forward, a few years, we now have a team under the mozilla research umbrella.

A

Who's working full-time on improving the language.

A

And we released version 1.0 last year.

A

And every 6 weeks we now release a new version, so we just released 1.13 and there is a large community around the language. Now so not only do we have developers working in mozilla on it, some of those developers are part of what's called the core team, and those are the people that decide the future of the language and help shape where it's going as time goes on.

A

So, in addition to our employees, we have volunteers and employees from other companies that are now depending on rust for their products.

A

And they're helping shape this ecosystem, which then has a large number of libraries.

A

That are being developed by people who are enthusiastic about the language. It's got a lot of downloads happening since the last time I gave this talk.

A

There've been 10 million, more downloads and 300 new libraries published.

A

So there's a lot going: on,, there's also the friends of rust, which I'll show you.

A

There is a page showing lots of different companies. That've told us.

A

"Yes, we are relying on rust in production....

A

...We are very excited about its prospects".

A

So, lots of cool things going on there.

A

So the reason for rust is that we have, in the past.

A

What 10, or more years of using firefox and javascript in firefox, sorry, c++ and javascript in firefox, we've come across the fact that there are some pervasive problems that are caused by using c++.

A

That is, writing code that makes use of local threads.

A

Is very difficult: it's easy to write incorrect code and it is very easy to write code which is unsafe.

A

And that translates into security exploits things that are stored by governments and by hackers all over the world and used to steal data from users and take over their computers using the browser as a vector.

A

there's, a huge number of these that are released every year.

A

By security investigators.

A

And there's competitions showing who can pwn a browser? The quickest.

A

So we looked for ways to address this.

A

By creating a new language- and it turns out that actually both of these issues make it difficult to write parallel code that makes use of modern hardware and writing code that is safe and not exploitable turns out. They can both be addressed by introducing the concept of ownership in the language.

A

So let's talk about what that means.

A

ownership encapsulates two ideas. Basically,.

A

It is what the owner of a value is and whether there are multiple owners of a value or mulitple users that are sharing a value.

A

And additionally, when that value is actually valid.

A

What is the point in the program.

A

In which it's actually safe to interact with the value.

A

And so from this, we can derive a few rules that if there is only a single owner for a value that value can be destroyed when the owner goes out of scope.

A

Because there are no ways to reference that value anymore,.

A

Similarly, if a value has only a single owner, that means that it is legal to mutate it, because no one can observe the change to that value.

A

And finally, if you have multiple owners, you need to have something called borrowing which is, you still have a single owner, but other people can observe it, but it cant be changed during that time..

A

So, let's talk about an analogy: here,.

A

If I've got a colouring book and a marker and some friends, we can establish some rules.

A

The colouring book and the marker are my property, so they go with me wherever I go.

A

If I leave, no one else can observe the book or colour in it. However, I am able to loan the book to someone else.

A

And that means they're borrowing it from me. That also means that I can't colour in it while they're borrowing it because that's rude, so they can also choose to lend it to people around them.

A

But that means that if anyone else is borrowing it, they need to give it back to me before they leave, because it's my property and only I can leave with it.

A

A

If I have the marker I'm able to colour in the book, if I have the book, I can also give the marker to someone else, and that means they can colour in the book if they have it.

A

But that means that I'm no longer able to colour, because there's only a single marker.

A

and finally,. If I want to leave, but I dont actually have the book in my posession.

A

There's a problem, either. I need to wait until someone gives me the book back.

A

Or I need to actually give it to someone else and say: "ok,: it's not my property, anymore, ...it's yours to deal with".

A

So ownership in rust.

A

If we have a type, we call a colouringbook.

A

And it gives us a constructor that returns a new instance of a colouringbook..

A

We can say. Ok, here is a variable called a book which we will say stores this colouringbook value..

A

That means that we can now call this colour method which will change the colouring book in some way, it'll colour in it., that's fine,. We can mutate it because we only have a single owner.

A

So what happens? If someone borrows the book?, we now have another variable called borrowed book and we use the ampersand to show that we are borrowing the value that's stored in this value called book.

A

This variable called book.. This is an immutable borrow.

A

That means that it is not possible to mutate the original value anymore, because it's borrowed., so we cannot colour in the book while it's borrowed by someone else.

A

This follows our analogy..

A

The other thing, however, is that if someone else is borrowing the book,, they also cannot colour in it.. They don't have the marker.. In this case, they only have an mutable borrow.

A

So they cannot mutate it.

A

So we can work around this by using, what's called a mutable borrow..

A

This says: ok, give me the book and give me the marker, and then they have both those elements necessary in order to actually colour in it and mutate it in this case..

A

So we have the ampersand followed by the mute keyword, and this means give me a mutable borrow to the value that follows.

A

However, the thing to note here is that we cannot use the original variable.

A

Called book in order to mutate it while it's borrowed., we cannot have two different people colouring in it, because only one person can colour at a time.

A

So, let's go back to the example. We had before., so we've got a book value, we're allowed to colour in it because there's no one borrowing it then, on the next line we have an immutable borrow.

A

And we're not allowed to colour in the original one again. This is fine. It's borrowed. It can't be coloured in..

A

So let's fix this. This is where we talk about lifetimes, because remember how I said that we can figure out when a value is valid?.

A

So this means that if we have a scope here, deliniated by the curly braces, this means that inside the curly braces, anything that is unique inside there no longer exists outside of them..

A

So if we create this borrowed book value- and we borrow from the book value- we have a mutable borrow and that's fine. We can then do something with this that doesn't require mutating it.

A

We can just look through the book,, we can investigate it, and that doesn't mutate, it,, that's fine., and so previously calling colour on the original book value.

A

Would've been an error because it was borrowed, but now the borrow no longer exists because it is only valid within the scope of these braces.

A

This is how we can control the scope of a borrow.

A

So finally, we can also transfer ownership..

A

This is how we talk about giving away the book to someone else.

A

By default, we can say ok,.

A

We'll create a new variable called book 2 and it will have the contents of the book variable.

A

And we can now colour in book 2., that's fine,, it's not a borrow. There's no ampersand there.

A

We are giving control of the value to another variable.

A

And additionally, if you try to compile this you'll note that we can no longer interact with the book variable because we transfered ownership, it doesn't exist anymore. The compiler knows this and can say "nope, that is not safe. What you're trying to do".

A

And you'll note: the link up here actually goes to a playground.

A

Where you can play with the rust compiler in your browser and there's a sample for this code, that you can experiment with there.

A

Already prepared for you.

A

So we understand borrowing a little bit better now, especially with the analogy, but how does this actually help in practice??

A

How does this address the two cases? We talked about before?

A

using values after they're no longer valid.

A

And writing code that works with multiple threads at the same time.

A

So, first with use-after-free problems.

A

Those happen in c++, because you'll have pointers in your code.

A

But the pointers are not associated with the value they're pointing to., so you could delete the memory that they're pointing to, but the pointers are still pointing at that memory, and so, if you aren't careful, you can end up using pointers that are pointing to invalid memory..

A

So in rust the compiler is actually tracking this.

A

So it doesn't let you write code that has the potential where pointers could point at memory that no longer is valid.

A

And that means that you're always taking borrowed pointers to values.

A

Where the compiler says "ok., I know exactly how long this value is valid. For...

A

...because, I know what the owner is and therefore any pointers to it...

A

...Must no longer exist before the owner no longer exists".

A

And additionally, you can also because the rust compiler also tracks outstanding, borrows.

A

You can also say "ok,. We are guaranteed that there's no way to mutate, this...

A

...While anyone else is borrowing and trying to look at the value".

A

And this addresses another case where this can happen in c++, where you end up changing the value like reallocating a pointer or something while other things are trying to point to.

A

Memory that it was relying on and as for parallel code with multiple threads.

A

The issue arises with data races, where you have multiple threads, that are sharing values and they're, also mutating them..

A

It's the same issue. We just talked about basically, where they're not coordinated in figuring out when it's safe to write to a value and when it's safe to read from a value.

A

Because you might get intermediate values when the write hasn't completed yet., so rust addresses this by forcing you to either transfer ownership of values.

A

That another thread needs to use so that two threads cannot share the same value or ensuring that any values that you do share between the threads abide by certain restrictions that prevent invalid writes from happening and invalid reads from happening, so that races can't happen and it's impossible to write code. That is not actually thread. Safe.

A

So how this actually applies to what we're doing at mozilla is that we've got the mozilla research organisation, and so part of them are working on improving rust. The language.

A

However, another part of them are working on building a brand new web browser, because firefox is not enough., this one's called servo and so we're building it from the ground up and the reason we're doing this is that there are decisions that were made design decisions for firefox that were made a decade ago, which are very difficult to change at this point in time,.

A

It'd be a huge amount of work to redesign parts of firefox. We think could be better, but it's also difficult to verify whether that would be.

A

A worthwhile use of time without actually doing it, so we compromise by creating a brand new browser where we can actually try out new ideas and give ourselves a playground to experiment with things we could do better in firefox and if they work out great, we can then start transferring them back into firefox and integrate them.

A

And additionally, this means that we can experiment with letting out pages.

A

Doing that in parallel, rather than all other browsers today, which do them sequentially and single-thread, we can do things like experiment, with the way that we redraw things to the screen and do it more like a computer game.

A

We can do things like change the way that we're managing memory for the parts of the web page so that it's more integrated with the garbage collection that the javascript code ends up ineracting with.

A

So all of this are things that we're doing in servo and we're getting some great results, and some of them are already being integrated back into firefox..

A

So we're already shipping foot code today in firefox, that's written in rust., for example, we have parts of our media stack where we have code, that's just responsible for reading parts of video files.

A

Which has been a source of security vulnerabilities in the past and there's no reason that should be the case, so we rewrite it in rust and we get safety by default.. So that's shipping in firefox today.

A

we've also got a project called oxidation, which is a list on the wiki of all the pieces that we're in the process of writing in rust in firefox. Today,.

A

Some of the most challenging ones that I mentioned previously, the rendering engine the style system and layout.

A

Those are being integrated into firefox today as part of the quantum project, and so you can basically expect that the amount of rust code in firefox will increase over time. There's been a lot of really good results, panning out so far,.

A

Especially for areas where they shouldn't be security, sensitive that they need to be high performance, those could be great places for integrating rust code because you've got those by default.

A

So if you'd like to know more about rust and mozilla, you can check out the rust playground I mentioned earlier.

A

That allows you to experiment with writing rust code in your browser. We've got a nice introductory book that covers everything you need to know about. The language called the rust programming language, which is accessible from the language website, and we've got irc channels.

A

Which are designed for both beginners, who like to interact with other people,.

A

Who really want to answer your questions right there, as well as a huge community in the rust channel, who really adore asking and answering questions.

A

That's all.. Thank you very much..

A

Any questions?.

A

A

What would be a good way to start contributing or participating?.

A

There's a few ways, so if there are.

A

Let me see if there are libraries that you would like to use from rust.

A

That don't exist yet writing either libraries from scratch in rust to scratch that itch very handy publishing that for the community or if there are libraries written in c, which already exist.

A

Which would give you functionality but don't exist in rust, yet.

A

Then writing bindings in rust around a c library.

A

Is very useful because that allows you to build safer abstractions on top of things that would otherwise be potentially unsafe, but is really easy to integrate with c code, which is one reason why it's working out so well to integrate rust in firefox..

A

There's lots of other suggestions on the rust website of ways to participate in the rust community.

A

If that's, what you're asking.

A

Yes, lucy?.

A

What are the most compelling reasons for someone to learn.

A

The language and potentially start participating and contributing?.

A

One thing I've heard is that actually people who don't already have what's called systems programming experience so a lot of experience using c++, for example,.

A

One of the lower level languages people coming from a web development background people writing a lot of javascript, ruby, python.

A

What I've heard is that people coming from those languages are actually getting their first experience.

A

Doing low level programming stuff.

A

But in a way, which is much less daunting,.

A

Than c or c++, where they know that the compiler has their back.

A

In ways that the compilers for c++, for example,, don't.

A

And it will tell you when you're making mistakes and it won't. Let you make those mistakes which is pretty exciting.

A

There are two people who I know who come from ruby, javascript backgrounds who are now putting together a series of tutorials for teaching people how to do kernel. Programming using rust.

A

With the intention that other people are coming from those high level backgrounds and trying this out for the first time, so there's a lot of ways to experiment with things that traditionally has been.

A

Rather, unapproachable for large segments of the developer, population.

A

Pretty compelling reason really and even if you do have experience doing c++.

A

And lower level things like that.

A

I find that not having to worry about whole classes of problems.

A

You can make as a developer in those languages.

A

Makes a huge difference: it allows you to reason about your code better.

A

It allows you to be more adventurous with your code.

A

(Inaudible audience discussion).

A

So the questions was one of the things people have talked about.

A

Is that rust should be able to make the process of refactoring your code.

A

Easier, safer, generally less complicated.

A

And less uncertain, and has there been talk of that?

A

Has there been evidence of that and yes, there's actually a really great blog post in the past couple weeks of someone who was refactoring their code and the compiler kept pointing out ways in which it would not be safe.

A

To refactor it in that certain way, because it was shared between threads.

A

Like he would fix that thing and it would go down the rabbit hole a little bit further and say "oh now this isn't safe anymore".

A

and was this very compiler guided refactoring session.

A

Which he wrote about and documented top to bottom, and it's great,, it seems to just verify the premise that this does prevent you from making mistakes.

A

Alright, let's call it there.. Thank you for attending everybody.