Zack Overflow

So, this is unhelpful and makes me think very little of you. Your other post is better so I'll reply to that. I will note that I almost certainly know more than you, so any sort of "you don't know what you're talking about" will be lost on my deaf ears.

Given my experience, you should question your own position, as, empirically, I have demonstrated expertise on this topic.

The fact that you won't make points but instead simply ask questions, I think, demonstrates how weakly you're able to express your own position. You're the one advocating for reasoned discussion, perhaps you should abandon this weak socratic approach and present your arguments?

> If you have a block of unsafe, is it sufficient to inspect that block of unsafe code if a change is made to a different part of the code that is not in an unsafe block if one is seeking to avoid memory unsafety? If he has done his basic homework, he should have known the answer to that and the consequences of it.

No, and I didn't say this. Memory safety is not a strictly local property and I never claimed it was, that's merely an uncharitable and naive read of my post. I said that `grep unsafe` gives you a starting place, because any memory safety properties (barring unsound compiler issues etc) almost necessarily involve an unsafe block.

> Why do some Rust projects which do not contain a single line of unsafe, still run Miri, a tool that is designed to catch some (not all) undefined behavior and memory unsafety, and which…

Sorry, but if he or you read and understood that link I gave (and it is not a long link, and it is interesting in my opinion), it would be quite clear. If he boldly comes with false statements about basics, then he cannot be said to be engaging in good faith debate. Especially considering the errors he makes regarding basic logic.

However, I can at least give you a hint: If you have a block of unsafe, is it sufficient to inspect that block of unsafe code if a change is made to a different part of the code that is not in an unsafe block if one is seeking to avoid memory unsafety? If he has done his basic homework, he should have known the answer to that and the consequences of it.

You can also consider this: Why do some Rust projects which do not contain a single line of unsafe, still run Miri, a tool that is designed to catch some (not all) undefined behavior and memory unsafety, and which can run 50x-200x slower than regular Rust? An example can be seen in https://zackoverflow.dev/writing/unsafe-rust-vs-zig/ , where the author used Miri to find memory unsafety in a dependency, upstreamed a fix to that dependency, and then encountered memory unsafety in a different dependency and gave up.

> If you use a crate in your Rust program, Miri will also panic if that crate has some UB. This sucks because there’s no way to configure it to skip over the crate, so you either have to fork and patch the UB yourself, or raise an issue with the authors of the crates and hopefully they…

> Additionally, I want to tyty to have better and more descriptive error messages than tsc's. Isn't this nice?: (https://zackoverflow.dev/tyty-errors.jpeg)

Actually, no. It looks fancy, sure, but error messages aren't there to be pretty, but to be usable.

1. I expect the first line of an error to give me a succinct, yet precise description of the problem.

Error: Incompatible types

It would never be possible for me to fix code based on this alone.
Contrast with Python:

TypeError: unsupported operand type(s) for +: 'int' and 'str'.

I'm sure you can easily figure out what code triggered the above error just based on itself.

At minimum, the first line should say which types are incompatible:

Error: Incompatible types MyType and MyType2

2. How am I supposed to read the

Because of this type annotation

part? Is it

MyFn has the type: X
Because of this type annotation

or

Because of this type annotation
MyFn has the type: X

?

To fix, include guiding punctuation:

MyFn has the type: X ...
... Because of this type annotation

or

Because of this type annotation ...
... MyFn has the type: X.

Actually, it looks like it's neither and I'm somehow supposed to read it as

Error: Incompatible types, because of this type annotation

... which is impossible to figure out without context. I should be able to read the error message top-down or bottom-up.

To sum up, error messages are there for the programmer to be able to…

Miri is good, but it still has very significant large limitations. And the recommendation of using Miri is unlikely to apply to using similar tools for many other programming languages, given the state of UB in the Rust ecosystem, as recommended by

https://materialize.com/blog/rust-concurrency-bug-unbounded-channels/

https://zackoverflow.dev/writing/unsafe-rust-vs-zig

>If you use a crate in your Rust program, Miri will also panic if that crate has some UB. This sucks because there’s no way to configure it to skip over the crate, so you either have to fork and patch the UB yourself, or raise an issue with the authors of the crates and hopefully they fix it.

>This happened to me once on another project and I waited a day for it to get fixed, then when it was finally fixed I immediately ran into another source of UB from another crate and gave up.

Further, Miri is slow to run, discouraging people to use it even for the subset of cases that it can catch UB.

>The interpreter isn’t exactly fast, from what I’ve observed it’s more than 400x slower. Regular Rust can run the tests I wrote in less than a second, but Miri takes several minutes.

If Miri runs 50x slower than normal code, it can limit what code paths people will run it with.

So, while I can imagine that Miri could be best in class, that class itself has significant limitations.

What's more important the amount of `unsafe` is if it's sound `unsafe`. The problem with `unsafe` is that it's even harder to write correctly than it is to write sound C/C++/Zig/etc. The thing about Undefined Behavior is that it gives the compiler free reins to introduce bugs anywhere in the program, safe or `unsafe`, and the thing about Rust is that it has much stricter rules about what is well-defined than most languages fraught with UB. And due to the nature of UB, these bugs may not appear until the function with unsound `unsafe` is called in a specific context, or you update your compiler, or you add a new dependency, or you add a line of code in a different file, or you delete a line of code in a different file, etc.. There are nearly infinite things that can set off the nasal demons you've given home to in your "mostly safe" Rust codebase. Here[0]'s an article talking about just this.

[0]: https://zackoverflow.dev/writing/unsafe-rust-vs-zig/

There are few reasons:

> Productivity > Readability > Performance > Static binaries > Not needing PhD in rust, especially async rust Rust works fine as high level language but it's absolutely awful for anything else and suffers from C++ feature creep. It would be a much better language if rust wasn't afraid of making `unsafe` an useful tool rather than thing that "everyone expect the core devs should absolutely avoid". Ergonomics would increase tenfolds if you could use it to essentially control the borrow checker better as well instead having to do mega abstractions (which aren't often zero-cost even) or hoops for every single thing.

https://zackoverflow.dev/writing/unsafe-rust-vs-zig/