Rust Programming Language Rusty Days 2020, 1 Aug 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Rusty Days 2020 - Tim McNamara: How 10 open source projects manage unsafe code

Description

Agenda ► https://rusty-days.org/agenda
Slides ►https://rusty-days.org/assets/slides/08-how-10-open-source-projects-manage-unsafe-code.pdf
Playlist with all talks ► https://www.youtube.com/playlist?list=PLf3u8NhoEikhTC5radGrmmqdkOK-xMDoZ

Follow ►
Facebook: https://rusty-days.org/facebook
Twitch: https://rusty-days.org/twitch
Twitter: https://rusty-days.org/twitter

This video ►
Is it safe to use unsafe? Learn why some projects need unsafe code and how projects manage its risks.

This talk will briefly discuss what the unsafe keyword enables and what its risks are. The bulk of time will be spent discussing how projects manage those risks. It finishes by providing recommendations based on that analysis.

Projects surveyed include:
* Servo (Mozilla)
* Fuchsia OS (Google)
* fast_rsync (Dropbox)
* winrt-rs (Microsoft)
* Firecracker (AWS)
* Linkerd2

A

Hello good morning, good evening, uh good afternoon, I'm speaking to you from uh before dawn in new zealand, and I am absolutely delighted to be part of rusty days. I think it's fantastic that we've been able to take all the the um roster warsaw team has been able to take what has been quite a negative pandemic and turn it into a global event, which is which is perfect.

A

I uh I should begin so uh just to reiterate. I'm sure this will come through on the stream, I'm more than happy to take questions by either any channel via twitch or youtube, or I think, there's a third channel also and just ask questions online and I will try to answer them as we go. The team is actually sitting behind me monitoring all of those streams. So that's great okay.

A

Where should we go we'll start with uh start with moving something?

A

Why is my screen? Not there? We are introduction. Who am I I tweet about rust um on tim clicks, I spend a whole bunch of time wasting time about rust on reddit. I do live coding on twitch. I make videos on youtube. um I write books, so um I've actually written this thing called wrestling action. uh One of the reasons why I do that is that I've kind of taken it upon myself to shorten everyone's learning journey by 100 hours.

A

um Now, if you have just decided to come to this talk, because you want to know how to apply unsafe to your own project, I've decided to just give you the answer. We'll give you the answer straight away, so you don't have to watch a whole hour of talking.

A

uh Firstly, at the top of your crate, add an annotation which is deny unsafe code. This will, as we'll demonstrate in some other projects. This will prevent the compiler from allowing you to use unsafe, unless you have been very, very explicit and told opted in the other one is that before or dur within an unsafe block, you need to explain why it is that this code is safe.

A

The compiler is no longer working for you, and so you need to do the work of the compiler for any future rust program, including yourself, who might come along and wonder why on earth is this safe and so one one way which uh I would recommend when you're doing the code review is to ask them, do you understand? Can you explain to me why that is safe um and if they cannot, then either the code needs to change or the comment needs to change.

A

Our objective as rust, programmers or one of the objectives, let's say or the objective right now- is safety, and, let's all remember, while we're going through this process, that other people make mistakes right, we we never make mistakes, but other people do so. How do we prevent their mistakes? From infecting our code?

A

We need to create a system of software engineering that makes it extremely hard for stressed, overworked and maybe distracted individuals to do the wrong thing. We need to create the system, as team leads, as uh as engineering managers as junior developers, we need to participate uh in a way that that gets the. It learns our objection, so we want to learn about how other projects are managing risk, but first I just I would really and like to take the time uh to talk about lemons and limes.

A

Now, if you speak english as a second language, this may sound very strange, um but um this is the story about how the british navy, or britain in particular, uh understood in the 18th century, how to cure scurvy and by the 20th century. They had completely forgot it.

A

In fact, the scientific advice at the start of the 20th century was so bad that it caused scurvy and the antarctic and expeditions quite famously um and led to some um uh horrendous tragedy, and so there were many reasons why this occurred, and one of the main reasons, though, is that the engl well, a contributing factor was that the english word lime included, lemons, also at the time in which the scientific and at the time at which the cure was found, which was use just drink lemon juice.

A

uh You know sprinkle some lemon juice into water and just drink that, and so I want to reiterate that, if your code comments cannot be understood by your audience, that is then they need to change and it doesn't the surface. It isn't the words themselves that are important. It's the meaning behind that people who are reading your code need to understand why it is that uh the code that you have written is safe.

A

You need to do the work of the compiler, for it.

A

First, a warning: this allowing unsafe is actually insufficient to guarantee safety. Unfortunately, rust still has some problem. Well, no, it doesn't have problems. It just has something to be aware of.

A

It is actually possible to generate code that is guaranteed to crash your program using only only safe code. Now this is a ridiculous code example. No one is ever going to wrap a vector of type t with another container, but maybe you're doing something stupid.

A

I say stupid, um maybe you're doing something, uh and you don't realize that you've created the situation where two of your primitive types, maybe inside a struct, actually are an invariant on the other one. So that is the position.

A

This position variable here relies on the fact, like there's an intimate relationship between storage and position that uh the compiler cannot guarantee, and so by mistake, let's in this case it's intentional but potential. Let's say by mistake: I've written some code that uh breaks the the link between two of the primitive types.

A

In this case, I can set position to something that is unreachable and then, when the next court like, if someone calls get this will break uh and it will crash the entire program now. Obviously I could have there. There are ways to to get around this. I could have replaced um this index notation with the get method and that would return an option, but this is completely safe code and it is 100 guaranteed crash. um So uh just before we get to the projects, I also thought I should explain a little bit around my methodology.

A

If there, if there was any methodology, um I firstly wanted to talk a little bit about the rationale about why I did this. I was really disappointed with the ross community's response to the ethics web, um unsafe, like basically driving if you've been around the rust community. A little bit you'll be familiar with this, but if you're very new um one very famous example of unsafe or the use of unsafe code, or was this project called actics web where the developer happily used unsafe blocks?

A

uh And then when people said look you can't do this? It's you know, there's no! There's no requirement um eventually that person was driven out of the of the rust community um now because of this kind of cultural difference and- um and that made me think like well how like what? What is the right way to do this?

A

If that is the wrong way, I think I think it was unfair to drive that person away um and uh the two main aims, I think, are to understand what it is that professional companies, people that are paid lots of money to write very good software and doing very hard things with rust, like what do they do, and I would also like to I just wanted to do some research to justify doing more research. Actually, I've got several ideas about how to extend this.

A

So what did I do sorry just to pause slightly doing qualitative research, not quantitative what that means is I'm I'm not looking for a. I haven't, hacked the compiler to be able to do an analysis, uh and this is quite um I've used a lot of interpretation here. So it's it's it's! It's not an analysis of every rust crate, it's kind of looking very closely at 10., and they were basically a sample of products or projects that I thought were interesting.

A

I tried to create a sample of open source from the gnome project, all the way through to like amazon and microsoft. These big big companies as well and I was looking primarily at their documentation for new contributors and then I would go in to look at their code snippets uh via like uh searching for unsafe inside their repository now. I intentionally did not communicate with any of these projects, um because um that I was doing this, so none of these projects are aware that actually they have been part of this um this project.

A

So let's, let's have a look uh server.

A

Servo is rust's foundational project. It was kind of the reason why it was created to create a parallel web browser.

A

It's fascinating, looking through the github, because a lot of the documentation around how to write code is written in about 2013.. So it's quite old from russ's point of view.

A

One thing I found fascinating is that they include this annotation of their crates, which is oh sorry, the annotation that he uses deny, uh but at the end, the start of any um function that uses unsafe within it they uh or any module that requires unsafe.

A

They are required to allow it and opt opt-in. So this, I think, is a really nice strategy for increasing the psychological barrier to including unsafe now just to provide a very. This is a again another convoluted example, but this is a demonstration of what happens inside servo, so you can imagine that they have modules and the module itself has this annotation that we deny unsafe.

A

The deny attribute allows programmers to later on annotate internal things with allow, so you can basically you're opting out of unsafe here, but you can opt back in if you really need it. The reason why I think this is quite a an interesting strategy is that I just feel like it's harder to and it's harder to do mentally, and it would there's no way it would pass code review. I think unsafe, would it's unlikely to pass code review, but this ugly annotation syntax there's no way that would get through.

A

um I was also curious as to what cargo giga does internally as well. So cargo geiger is a cargo extension which actually inspects your own code and all of the code of your dependencies for usages of unsafe. um But how do they do it themselves like this? For me um was really really interesting.

A

They've gone further than deny unsafe, they've actually said forbid. Now the forbid keyword or the forbid attribute does not allow you to annotate internal methods as allow unsafe, so it just entails the entire the compiler that it's completely illegal.

A

Future programmers in the project will only be able to include unsafe blocks if somehow the project decides to like remove this annotation from the root of their crate so effectively. The way this looks in code is uh with, we add for bid, and then it's impossible to like the only way to compile this dangerous function is by commenting it out like there. We cannot, we cannot opt in to allow it will not. The compiler will refuse to compile the code.

A

uh Again, kind of looking into some of rust's ecosystem well, some of the long-standing utilities. I wanted to kind of get a sense as to whether or not.

A

The the the cultural- I wonder if I wanted to know if the unsafe usage had changed so ixa is a replacement for the ls command, which is a unix utility and it it's one of rus. The rust community's oldest command line, utilities that is in public use so and xa talks to a file system, and it does that via system calls, uh it doesn't need many it uses, it does not use much unsafe at all, but for extended attributes inside uh it requires this.

A

um The list extra attribute uh cycle family on linux and mac os, so the strategy that they have developed is to employ to only wrap the minimum of what they need. So basically, every single function that they wish to call now I'll, explain the syntax very quickly um in just a moment but effectively.

A

This is the rust code, and all they are doing is wrapping the c like wrapping the c function, and so the strategy there is to put unsafe around the smallest element possible, and the idea is, I assume, to make it very, very understandable about what is the purpose of unsafe, and in this case we are.

A

uh The reason why we need unsafe is because the rust compiler cannot reason about what happens inside the operating system, and so it just requires you it. We just need to expect that the operating system is going to be well behaved. Now going back to the uh to that comment around, we need to understand why this is safe.

A

um If you haven't used pointer syntax, this is probably confusing uh I want to um so. First of all, we have a whole bunch of types that are not you really used in traditional rust code, but if you're using libc, if you're, using any ffr you've, probably seen that before and if you've programmed in c. This probably makes some sense.

A

We take a path, so we the the uh a pointer to effectively and in rust syntax. This would be a vehicle u8. We've got a reference to c string. A c string is like a vec of u8 with a null uh byte at the end and then we're creating a null pointer which, in the convention of c programmers, is to spend in null pointer kind of how a rust programmer would use an option.

A

Zero. I'm not sure what that does. So that is, I think, size.

A

And uh and we have a an integer being used as flags and the way that that works is that nc uh a convention is that each bit represents an on off switch and, um and so that's what that's going to be used so bear in mind it's important to think about whether or not your team is familiar with this kind of code.

A

If it is, maybe it doesn't need comments, but if it is like, if you have team members- or you might have new team members that are less familiar with this type of syntax, be verbose, oh, so that this is where it came from. um Another example that uh I think is quite interesting is black three, so black three is this new cryptographic hash function, that's supposed to be um really fast and also very good.

A

Oh, I think I've just received a I don't know. I haven't received a comment, oh by the way, if you're watching this live, do ask questions uh more than happy to receive them as we're going through.

A

You have stopped using md5, just just just just just asking that question right: it's no longer it's no longer best practice. So why is unsafe needed in this project? Well, blank three wants to make use of very high performance uh functionality within the cpu, and that requires intrinsics access to intrinsics. We have vector instructions. We can operate on more than one um element at a time, so they have used their minimal rapid strategy as well.

A

Now this is a kind of a like a s like a vector. Well, actually, it's closer to an array um that has a width of 256 bits of integers and we call this kind of crazy thing in the middle. This is what the unsafe um this is. The function that's provided by um and if you've used making no sense.

A

This is a function that is provided by the compiler when you opt into intrinsics your and from the rust code.

A

We only see ed, a lot of the complexity is hidden from us and I think this is a really really interesting strategy.

A

Now. One thing that the authors of the crate have decided to spend extra attention on is that when we use pointers in unsafe blocks, that's especially dangerous and we need to be especially careful and so um they've made extra effort to annotate those sections with code comments.

A

Now uh I get into a project from amazon, and this is the foundation for the aws lambda and the aws fargate projects, and um it's a so first we'll start with a question like: why do they need unsafe, well, they're, interacting with a hypervisor they're, basically building an operating system manager, um and they also use a lot of chrome os inside their own project, and so they've actually got a lot of code generation and so their strategy, and I I don't mean to blame them. It was just I thought you know.

A

They've just got like it's co automatic code that includes them safe and so there's just this comment. There saying this is automatically generated and so that's their strategy for a lot of for a lot of their uses. um Just as a comment saying, um I don't know why this is safe. Sorry, um oh the um I wanted to call out their contributing markdown files. Sorry, it hasn't rendered very nicely on the screen.

A

The point I want to make here is that they have a big document which explains why you should or how to contribute, but it doesn't address unsafe at all.

A

It talks about code, comments and and and so forth, and pull requests and unit tests and and that's all great, but this is an operating system project and they don't mention unsafe in any of their guidelines.

A

um Windows. Oh sorry, microsoft is developing a language prediction, um otherwise known as a rust interface for the windows runtime, which I think is ridiculously exciting, like it's amazing to see that rust's uh usage across operating systems is first class. So, thanks to microsoft, um obviously they speak to windows apis, whether or not there is um like kernel, 32 dll or, whichever interface that they use. um They need to trust the operating system, and so they have to use unsafe, so their strategy again. Are these minimal wrappers um slightly differently so previously?

A

So this is a bit of a confusing method to see um what we're dealing with here is an array of type t which happens to be generated by the windows runtime, so it um it allows you to create.

A

So what we're trying to do in this simple block is create methods that allow you to create uh objects that the windows runtime understands now um there are several other methods as well, but I want to call out with len, because I thought it was. This is where we have unsafe and so um the uh so.

A

This is a career, we're creating a new object here, so this is kind of like the width capacity, only it's uh vic with capacity, but here we're creating an array with with the length of guaranteed to be let's say, 10 24 or something um we want to make sure. First, there's this assertion, which is good practice and then um we're saying that this is this code task memo is the call that we need to use, which is fine, um but I am personally I mean if you are a windows like a microsoft programmer.

A

You probably understand what this means like innately, but it feels like to me as someone who's looking at the code fresh, that this unsafe block is doing quite a lot of work inside it, and so what we're doing is we are calling this part of the windows, api and we've got our length.

A

So that's the number of elements in our array and then we multiply that by the size of memory of of our type, and so you know you can kind of see where that's one function and then this returns something and then we coerce it to a pointer to t. So maybe if you are familiar with systems programming, this comes very naturally to you, but um I think that if something were to happen inside one of my projects, I would have expected that I would have provided some explanation about what is happening.

A

But again, maybe if you're developing systems um programming like if you're developing operating systems, this stuff is so natural that you don't need to. I'm not sure um I do know as well that they provide annotations as to describe why it is that uh the um operation is safe and so we're actually writing to the pointer um to um starting at zero. I assume so this is a point. Data is a as a pointer, so we just created it there. We, I assume it's we start at zero and we write length.

A

I'm wondering- and I don't know enough about um about this, but I assume the difference. Interestingly, we've got length multiplied by cis meme like this, the, but here I'm using ling, and I I wonder whether or not that's a bug, I'm not sure um I'd, be interested to hear from anyone. um Can I enlarge the code?

A

Yes, yes, okay,.

A

Hi, read me mark down, so what I really like is um uh the windows, the windows. Sorry, the microsoft team believes that they want to create this runtime within 100 pure safe rust, but they make this um call out that sometimes that they have to go and talk to their um to the to the apis and they are implemented in c plus plus and they make safety as like a first class citizen in their readme, which I think is a really positive sign.

A

Now a project from the gnome project sub from a project within gnome, is there uh they're, rewriting libby's, uh I think lib, um a c library in rust. So this is uh a csv renderer and the question becomes: why do they need unsafe?

A

Well, this crate uh lube, rust, rsv g, esp talks to gleb glib is a kind of a core of um of gnome in some sense, and it is like another c library. So again, you can see this pattern of requiring we're building out new functionality in rust and we need to rely on older implementations or not older, but pre-existing code that is written in unsafe languages and also rust itself. Sorry, the rust code itself exposes the same c api as the library that preceded it.

A

One thing I think is really positive in this project is that the entire culture focused on questioning whether or not unsafe is a valid thing to do now. This is a code comment um from one of their code reviews inside a mood request, which is get lab's version of pull requests, and you know the project lead. There makes this really good point, which is: why are you using an unsafe construct, because I think that we could use a safer option instead?

A

Now I found this inside their code after like looking through their commits, and I think it's really positive to see that people have got in their heads. This idea that if we when we can avoid unsafe, we should do so because the compiler is the compiler does not get tired.

A

The compiler does not get distracted and the compiler um can have bugs. I'm sure that they can find the bugs, um but rust's uh safe, rust is, is good. Rust uh we've seen the minimal rapid strategy before so we'll just pass on that one. I also wanted to look at the rust standard library.

A

They have provided explicit advice for code reviews.

A

They require comments around each use of unsafe and they have some tooling a lint in their continuous integration bills that checks that there is a comment. Obviously the lint probably can't read the code comments to check that they relate to the code block, but at least they're there, and there are humans, checking these things as well. So I like this- I like the last sentence here. Unsafe code actually needs to be okay, like it don't put unsafe code in there.

A

That is actually unsafe, like that, is not a good thing to put inside the standard library.

A

Another thing that they call out inside their their guidelines is that it's okay to ask for help.

A

So if you so we we mentioned, we see a mention here of the unsafe code guidelines working group and I'll mention uh what they, what that is very, very soon properly.

A

uh But there are experts with inside the rust language that know a lot about rust, and so, if you are unsure it's okay to ask them for help. In fact, they've made this point that everyone loves debating whether or not there is an unsound problem here like whether or not so you know don't be worried. You know you're actually making someone's day by by being able to get some some reasoning here and some expertise.

A

uh Now, if you are a tiny project, this obviously does not apply as equally to you. So you know we don't have a large team of of uh collaborators and colleagues to call upon, and so um my advice there would be to be cautious and to kind of build yourself up into things that you know, rather than things that you don't and don't try to use constructs that you don't understand. As that's what I'm saying there.

A

One thing I think is really really really good. Is that.

A

The public documentation explains why things may panic, and if you read the code, comments of standard pointer, read you'll, see that there is invariants that are described, which is that the source of where you're reading from must be valid for reads and so and by the way you must initialize their value before you actually try and read from a pointer, and so without those um the the method is unsafe, and so, even if size t has psi zero, the poi pointer must be non now that which is interesting.

A

But um so I think that including, if you have an unsafe method or unsafe function, including a safety section, is a very sound strategy.

A

A further project which is less less well known as um this thing called toolshed toolshed, is a a memory allocator.

A

It uses an arena strategy or provides an arena for you, which is basically to the operating system. It looks like you've just asked for a large chunk of memory and inside your program. You can divide that up internally. However, you want it's typically faster, but can be slightly less efficient. You might get some wasted space now. Why do they need unsafe?

A

Well, if you're dealing with memory blocks, you probably need to deal with pointers, and that means that you uh need unsafe, and so their strategy has been to push every usage of unsafe into one specific module which happens to be arena.rs, even though the api is completely safe.

A

All of the unsafety is is uh isolated with inside one module, and so people know, if they're touching, that module like it's dangerous and uh again like we're trying to create a situation where, as a team, we are building safe software and mentally we're switched on when we go and interact with that module.

A

So again, here is a another project which is far less well known, which I think is really interesting, is a new database that a new graph database actually being developed out of ireland and inside it it's. The storage engine is written in rust, but the reasoning engine is written in prologue.

A

Now they need unsafe, because they're interfacing with this prologue implementation and now have they done that they have gone further than isolating at the module boundary in some sense, they've actually created a third crate, so they have uh which provides the sort of a wrapper and interface as a completely outside of their project or their core storage project. So the storage engine, the written and rust that deals with keeping data and persisting it to disk has no has no knowledge of the the prologue implementation.

A

It's completely independent, and so if there was a problem with inside that kind of wrapper crate, it wouldn't infect the storage engine. uh They also have a very strong straight, like a very strong uh co-commenting practice within, say the team, and so um almost you know seen on the slide. It's a bit difficult.

A

So allow me to explain, what's happening here so um inside so inside their code when they store data to disk or unsigned integers to disk, they compress it using a variable length, encoding scheme, uh there's a public method in kodiak that allocates a memory, so we create a vector of size of size, length and uh and this and then we call an internal method really, which is encode inject even at this wrapper um like even at the this, isn't really unsafe, we're just calling an unsafe function or an unsafe method.

A

There's already a safety block saying we know that we have created our vehicle with the required length, and so therefore it is safe.

A

And inside the that that unchecked method, the encode unchecked there's even more commenting, so this is the internal method.

A

Basically, everything that happens inside this method is well indexed.

A

Possibly you know. We don't necessarily need to say that about incrementing, um but what I think that this project gets right is that they want to assume that people are looking at this code with very, very blurry, tired eyes and uh they're, even specifying why we're using an integer, sorry, an index integer, which I think I've never seen before, and this makes it very very difficult to not be a it makes it very difficult. It makes it very easy to understand what the code is doing and very hard to to get it wrong.

A

In my opinion,.

A

Okay, we're coming up to one of the final projects that I want to touch on, and uh this is fuchsia from google.

A

So the fuchsia kernel is actually written. uh It's not written in rust. Rust is using as used in kind of systems components, um but the kernel, I believe, is written in c plus plus, but might be um pure c.

A

Their team, they they have got code documentation. That uh makes it very clear that if you're writing adding unsafe to the code, you need to resp. uh You need to ensure that it's safe. It's your responsibility and it's essential that you identify any assumptions that are required by every unsafe block.

A

You need to ensure that those assumptions are actually met, not just that you've identified them, but actually with that in this case that they've been met and over time, it's possible for those assumptions to continue to be met. Now. This is a really interesting and a really interesting bullet point to add, because it means that the programmer today is responsible for thinking about how people might use this in the future.

A

And this becomes even more explicit uh soon um further! Oh right! Sorry, I just added the twice! uh Oh well! um I just uh I yeah we'll carry on.

A

So one of the things that is um very clear by now is that projects that do this well use unsafe properly, I said properly add comments to the unsafe blocks to explain why it is safe and if you're inside the future project, you also require a comment explaining you know what assumptions are being made like previously.

A

We saw that we made an assumption that the length being provided to a a pointer, read or pointer right was of sufficient length, and so um that seems relatively clear, but this documentation is actually available in public for every contributor to the project. um Oh.

A

Sorry about the rendering of this um slide where possible. So this is a very good explanation for the minimal wrappers strategy, so, where possible, package any unsafety into a single functional module and then document what it is. That needs to be the case before it becomes safe, how things fail and uh how things uh what happens? If everything succeeds now, this um seems like a very, very sound strategy to me. um The google, this the future oes project um has the most robust guidelines. In my opinion, for writing. Unsafe blocks of code safely.

A

Partially, for this reason,.

A

You know I apologize for how this is rendered on the screen, so there's a couple of sections here, so there are three particular types that the documentation calls out as being particularly dangerous, start const, star, nut or unsafe cell. So these are pointer types.

A

They are does they are um specifically called out as things that need to be very heavily documented and the uh coming down. The bottom is talking about memory aliasing and that um you can either in rust. You can you can either alias. So that means you can have two shared two references.

A

uh It's got read only references, so this is the ampersand syntax. You can have multiple of those. You can have multiple readers, but you can only have a single writer and you need to explain that if you have been able to if you've used one of these unsafe types that you have uphold, that guarantee that is provided by the rust compiler.

A

Obviously so now these resources, you can't click on the links. Sadly, but you can definitely look them up and I will ensure that links are provided um for anyone that would like them and uh um just thinking about the way to get them there.

A

um But uh I'd like to call out the future os team, brian anderson, ralph young, has provided two fantastic articles in particular, was the person who created that example of having two types that are both safe and of themselves, but when they relate to each other, and you break that connection, you can create unsafety inside safe rust, there's a really nice guide of rust patterns within so the rust unofficial repository that talks about condensing or containing or isolating unsafety within small modules or and lastly, the unsafe working groups unsafe code guidelines for reference, which I want, oh, which I would like to see if I can bring up now.

A

um So uh where are we.

A

So inside the rustling um org is a uh unsafe code guidelines repository and you may notice this. um This author, ralph young, is the same person who wrote those two fantastic articles about unsafety and rust.

A

A

This is a very good description of the things that you need to be aware of. If you are writing unsafe code- and you want to be able to it- isn't quite as mature as I expected it to be, um but I think it is developing and if this is an area that you're interested in, I believe that you should continue to.

A

um I think you should participate.

A

So it's the main output of the group is a is a reference document and I'm sure that this I'm sure that there are many patches welcome from anyone inside the community, and so that is. uh I think that is the talk actually we'll, um I'm more than happy to answer any questions that people have, um but just a a moment again to say. Thank you very much for the organizers of the conference.

A

I am uh very privileged to be part of it uh even from the other side of the world, and so I am more than happy to stay online and uh again answering any questions that come through I'll. Try to get a um I'll get a link. Try I'll try to post um that in the youtube uh comments to where I have the slides and so forth, um and.

A

uh Yeah ask away ask away and any of the in any of the channels that you're, um if you're, watching the stream ask the in the comments and um and those comments are being being.

A

A

I'm just assuming that organizes a link and.

A

Of the slides that I have as well as the research that I've done on all the projects, because there's a little bit of of more material there, that you might be interested in so we've received our first question, which I think is a really fascinating one and it's from youtube, and I believe it's uh um I'm going to get my english pronunciation is going to be terrible of this name.

A

Sicaris, what would be your advice to new ross programmers who are too happy to use unsafe.

A

So if I re, if I re so the question there is you have someone who is new to rust. Maybe they have a lot of experience or they have just graduated from university and they look at unsafe and they say: oh.

A

Using unsafe just means, I can apply the same idioms that I am used to in c plus or in some other language, and uh my advice would be that the reason is is to ask them to step back and say. Well, why are you learning rust.

A

You know you can write, you can use pointers manually in other languages in, in fact, in a way that is much more ergonomic. Rust makes it very fussy, uh it's it's. It's not nice to use unsafe, like use pointers in rust, like I think it's done intentionally, it's intentionally clumsy in some sense, and if you have come to rust, because you want to write in a safe programming language without a garbage collector then use the compiler to your advantage.

A

So there is a second question from um from youtube again I apologize for my um my english pronunciation, especially the stress on the wrong part of the word, but um michelle uh lazovsky great lecture. Thank you which strategy is the best in your opinion, yeah.

A

uh I am not an expert in this. I would defer to uh the unsafe working group, but if you were going to ask me for my advice, it would be to add a comment to each use of unsafe and that will force you to mentally check.

A

It will just slow you down and cause you to pause, to double check that what you are doing is sensible.

A

That would be my one takeaway from twitch um hashidong you've covered calling unsafe code inside functions, but what about creating functions which are themselves safe? Do I have any thoughts on that?

A

I do, and that is we uh I don't. I could try and potentially try and scroll all the way through. uh So where was I I was over here? Oh um so, I think it was. Ixa has created a function like a rust function around a c function.

A

Oh actually, it's a say: function around an unsafe function. um Actually that wasn't quite what I want to do. I believe, oh, no, that's not right either.

A

So my strategy for this is to write, minimal wrappers around uh around and create functions that are very, very easy to understand.

A

Okay, another question from twitch dot. Chris, please. Thanks for the talk you mentioned, some links that we can use to assist developers and maintaining code with unsafe. Are there any changes to the language or any unexisting ones that you would like to see introduced to make this easier and more a lot more reliable.

A

I would say to that use clippy right so.

A

A

See if we can find it rust clipping.

A

Not in there repository come on github, let's, let's do this properly. Okay, there we go, there's rust slippery now. Rust clippy is a community repository of good practices, hundreds and hundreds of these things- and I love this code. That is just wrong. Do not use this in your own thing. uh So now you I wouldn't I don't I I. I expect that the lint that this code comment linting that is applied by.

A

I think it was the uh one of the projects anyway, I think it was a standard library, I'm I assume that they have upstreamed uh their lent into clippy. This is where I would go and if they haven't well, you know there's a job for this.

A

Weekend now, oh, this is great again from twitch um mro wqa. Why do you laugh so much? I love it.

A

I laugh because I'm nervous partially I I laugh because uh I try to remember that programming is primarily creative and different and.

A

It's okay to learn: it's okay, to make mistakes, it's okay, to um it's! Okay, to grow, and that means that we need to do the we need we. We need to learn in a way that is supportive, and so there's no sense, and I I I don't want to start telling people or dictate exactly how people should code in their and I don't want people to feel as if they are inadequate in any way.

A

One of the things that one of the reasons that I wrote program and rust or and learned and took the time to learn rust, and one of the reason why I teach rust is that it empowers everyone to write strong, safe software. Even me like, I am an I'm a mediocre programmer in many senses. uh Yes, I've and you know I developed in python for a long long time and probably over a decade and spent a long time in data science, everyone every every piece of documentation that I wrote that I read around writing c.

A

Extensions to make python go faster was the first paragraph almost said: only expert should do this or you know this is dangerous. You know or what some sort of language like that, and I was always intimidated. Rust was the very that was the first systems programming language community.

A

That made me feel welcome, and I want other people to feel welcome as well. It doesn't matter where you come from. Does it matter whether or not you're from the san francisco, you know from the bay area or whether you are from south asia?

A

You should feel like a participant and, and- and you are- you have a place at this table, and I want everyone to feel welcome, okay, a question from youtube from android bogus. If my unsafe code is unsell but works, for example, it might be faster, should I change it for uh a slower, but something that is guaranteed a slower version that is guaranteed to be sound.

A

We have an example of this in the standard library or not so much so it probably is the case that if you have something that is fast but dangerous, then it is. It works for non-good cases like. If you set everything up correctly, it will go fine, but if things are set up badly, then they might blow up and explode on you.

A

I do not recommend anything that is like that, takes user input or anything you're going to install in someone else's computer.

A

I do not recommend that you expose them to security vulnerabilities caused by buffer overruns, but if you're the kind of person that likes to play dangerous, um here's my advice to you create two methods: the first one and the one that you should use primarily is safe code. It is pure rust that is pure, safe, rust.

A

Secondly, have another method that has the same signature but has underscore unchecked or underscore unsafe and describe why it is that when you call this that, like what are what you've done to ensure that it's safe, when you call it, if you know that certain edge cases will cause it to explode, call the safe method like if you might be in a situation where they might occur. But if you know, if you have initialized, if you're doing psycho scientific community scientific computing, for example, you know all of your data uh pretty intimately.

A

You know exactly how it's laid out in memory and so forth. You can probably guarantee that the edge cases will never occur. I am not smart enough for that, so I I would urge you to. I would urge you to stick with safe, but if you want to you know like yeah, then that's over to you, uh okay, uh another question from youtube: zoran uh lazarevkich, have you ever had situations where your unsafe code has broken, broke the safety and rust and can? And if so, can you give an example of how that has manifest?

A

No, I have not. I haven't broken the ross compiler. I know that some other people have, for example, I believe there was a regression in 145 relating to uh the use of. um There was a a strange edge case relating to propagation of constants, like an uh like toy code with references, and um uh I haven't experienced that myself, okay, so um youtube michelle lazovsky. Is it possible to have in your project too many comments that slide with terminus tv had quite a lot in my opinion, I agree.

A

I mean it's very, very difficult to know where the balance is.

A

Perhaps the balance exists. It depends on the maturity of the project.

A

I can imagine that if you know that there are very competent developers and people who are very familiar with the domain, that you don't need many comments, but if unsafe is a warning to you like, if it there are some people, they see unsafe they're like wow, hey like this is this is my play area. Like I love this stuff. um I love pointers. I love it. So it's all fine to me, then.

A

um Maybe they don't need comments, but if you're the kind of project that uses unsafe and less than one percent of their code base, like probably uh most projects and whenever someone sees unsafe, they kind of tense up slightly, because they're worried that they're going to crash their own system or potentially introduce security vulnerabilities for their users.

A

Add more comments. I don't know if every single line needs to be commented, I thought it was interesting to find a a code in production. At least it provides more robustness.

A

Oh okay from twitch soulless waffle is that, like somehow reflective back on me, the user name is solace ruffle. I really enjoyed your talk thanks, but I have one question: what would be some good starting points for developers who are new to lower level programming language who want to learn how to safely write unsafe rust?

A

Do you know of any resources that teach these skills from a rust perspective?.

A

Solas waffle do I have a book for you.

A

I will I I feel very uh I I don't do this, because it's an ad I apologize uh if this offends anybody, um but I do think that my book is designed to do that exactly, and so I think it's appropriate here. The uh rust in action book teaches you both rust and systems programming.

A

At the same time, it does that it will introduce you to unsafe. It doesn't go through all of those explanations, but it does make you familiar with um with uh some of the reasons why you might use unsafe, and so um hopefully, hopefully, that's true, not too much of an advert, but I would recommend uh in taking a look and checking the reviews and checking whether or not this seems like something that might be sensible for you uh youtube from andrew burgess. By the way, ask me if you want alert and clippy.

A

I think I want a lint in clippy. I think the community would love more robustness around unsafe code, and so uh I spent a little bit of time and probably too much time should have been preparing for the talk um inspecting clippy and I originally well.

A

I originally wanted to run linters over every public crate in crates io and maybe some uh and try and find out whether or not I wanted to go and inspect the uses of unsafe to say like what are people doing? Are they manipulating pointers? Are they doing um some weird things like transmutation like in interpreting the bit patterns of uh of, like various, you know like an uh an array as as integers and so forth, um but um but no oh, we've actually got quite a few. Oh two, more comments.

A

I would, um and so you say, yeah sorry to answer that question. Yes, add the lint, I'm sure that logic, um the the maintainer of that project will be happy to accept it. um uh Twitch louis code does rust, have a way of marking unsafe code and working smoothly with it like on haskell's, I o monad, maybe an unsafe trade marker that is the unsafe trade. Sorry, that's the unsafe keyword itself. I would say um you're not going.

A

I there are people who probably are type theorists and who understand rust type system, very uh innately, and I but I'm gonna, I'm just gonna- admit some ignorance there. I think that there are you could possibly have market traits. You could definitely create something was like you know, um you could create a market rate which implies unsafe. I believe uh yes and I and just thinking of the top of my head.

A

I'm I've never done it, but I think that there are unsafe traits and so as soon as you implement that you mark your own type as unsafe, but I.

A

um Yeah, I I'm going to express a little bit of ignorance there and just and just allow the uh the type theorists and the back channel ask ask on reddit ask on users.ruslan.org and uh and find out because again participating in the russ community is exactly why uh rust is great.

A

These technical, these technical reasons, are fine and perfect. um You can see that other language communities are adopting a lot of the uh you know. D is investigating very uh as investigating lifetimes and um and c plus, plus, have lots of have changed their practices to be able to use smart pointers rather than raw pointers, for example, and so the technical parts of the rust community, I think, will be adopted by other languages.

A

What we have that's special is the participation in the community aspect, and so, if there's something that's unfamiliar to you, I would strongly encourage you to ask we um now, michael ward on youtube, asks a question: why do you feel like bad about promoting my book? uh I'm eighteen percent and it's great okay.

A

I feel bad about promoting my book, because people have to pay money for my book. um I uh I've been working on open. I mean I've been contributing open source code for like 15 years, something like this, and I just find it very difficult to ask for money from people, um and I think especially from people who are learning and who don't know what is good and what is not. I don't, like uh you know about 90 of people that read my book. Think it's excellent, no about eighty percent.

A

Think it's excellent about ten percent 10 to 15 is very good and about five five percent want to throw it in the boot and like throw it in the fire.

A

So uh now I don't want to recommend that you should buy it if you're going to throw it in the fire and so um yeah. I I don't.

A

um uh I don't know I it's just a personal thing. I I should get better at asking for money, I'm going to give like an extra 10 to 15 seconds uh for me to make a decision on the most interesting question. The most interesting question actually receives a. uh I think we, I think manning my publisher has provided some codes to the organizers um if you are selected.

A

So if you think of anything, ask a question away like ask a question I'll try and include it, but I'll, try and pick a winner if you are the winner, please stay on whichever channel you have uh asked your question on such that the organizers can contact you to send you the code.

A

uh If you are interested you're talking about, if you are interested in buying the book, if you go to rustanaction.com, there's a 40 discount code on that page now I actually really liked the first question.

A

What would be my advice to russ programmers who are too happy to use unsafe?

A

I think that this is very interesting from like a psychological point of view, because it talks to the culture of people that are new to rust and try, and you know, there's a lot to this idea that bringing people to a new power like it there's a there, are multiple mental shifts that happen when you learn the rust programming language and uh one of them is this idea that you need to trust the compiler.

A

You know the compiler is not your enemy, your compiler is actually your ally, uh you you, the compile the rust compiler actually is on your team and so um yeah. I I I find that you know it's not um so I. I definitely think that that one. um That, for me, is the most interesting or kind of the most compelling question. I think it's the one that if I were to have a beer with with you all after the cop, because you know we're going to the pub afterwards right, uh the um that's the question.

A

I think I would spend a lot of time trying to flesh out and explain and understand. So um that is um the winning question for me um again. If um uh I I would just like to to thank the organizers based in uh poland um for organizing this worldwide event, I think it was fantastic and I have been uh I've been you know, delighted with um well, it's been it's been fantastic presenting to you all. So, thank you so much.

A

But first I've just got one more announcement and that is.

A

I think the that is that there is a hackathon. If I go to rustydays.org.

A

And I look for a hackathon link. Sorry, my internet has decided that it wants to go very slowly um here. We are the topic for this year's hackathon is emergent phenomena or perhaps, if you prefer, can you amaze us with simple rules?

A

Let's create an amazing result with a simple ruleset if you've ever heard about cellular automata, fractals or similar constructs. This is what we're kind of talking about, so allow me to do one more plug.

A

Actually, if you would like to learn about writing a freckle in rust, go to my youtube channel, I have a video which is describes how to uh generate the mandelbrot set in rust, and that can be possibly a good and I've got some other generative art tutorials in there as well, and so in particular, this one is about creating some generative art in rust and we kind of work through a tutorial. So I uh I would encourage you again yeah to look at my youtube channel, so that is um youtube.com timflix and uh great.

A

I encourage you to participate in the hackathon. It's going to be fantastic and um and have a lovely week. Oh a lovely weekend and a lovely evening and I'll see you at the pub because this it's the last talk of the conference right.

A

I'll see everyone later take care.