Wedson Almeida Filho is a Microsoft engineer who has been prolific in his contributions to the Rust for the Linux kernel code over the past several years. Wedson has worked on many Rust Linux kernel features and even did a experimental EXT2 file-system driver port to Rust. But he’s had enough and is now stepping away from the Rust for Linux efforts.
From Wedon’s post on the kernel mailing list:
I am retiring from the project. After almost 4 years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it’s best to leave it up to those who still have it in them.
…
I truly believe the future of kernels is with memory-safe languages. I am no visionary but if Linux doesn’t internalize this, I’m afraid some other kernel will do to it what it did to Unix.
Lastly, I’ll leave a small, 3min 30s, sample for context here: https://youtu.be/WiPp9YEBV0Q?t=1529 – and to reiterate, no one is trying force anyone else to learn Rust nor prevent refactorings of C code."
I admit I’m biased towards C-languages out of sheer personal preference and limited exposure to Rust but I am wondering, are there any major technical barriers to Rust replacing these languages in it’s current form anymore?
I know there has been a lot of movement towards supporting Rust in the last 6 years since I’ve become aware of it, but I also get flashbacks from the the early 00’s when I would hear about how Java was destined to replace C++, and the early 2010’s when Python was destined to replace everything only to realize that the hype fundamentally misunderstood the use case limitations of the various languages.
Its mainly a matter of stabilizing existing features in the language - there is rust in the linux kernel as of 6.1 but they have to be compiled with the nightly compiler.
Rust is a very slow moving , get it right the first time esque, project. Important and relatively fundamental stuff is currently and has been useable and 99% unchanging for years but hasnt been included in the mainline compiler.
Also certain libraries would be fantastic to have integrated into the standard library, like tokio, anyhow, thiserror, crossbeam, rayon, and serde. If that ever happens though itll be in like a decade.
Oh and try blocks.
omfg, that guy in the video…
What is so hard to understand, C Is a fucking security issues?
Ted Ts’o is a prick with a god complex. I understand his experience is hard to match, we all have something in our lives we’re that good at, but that does not need to lead to acting like a fucking religious fanatic.
I understand his experience is hard to match, we all have something in our lives we’re that good at
At some point, that mix of experience and ego becomes a significant liability. He’s directly hurting the adoption of Rust in the kernel, while the C code he’s responsible for is full of problems that would have been impossible if written in safe Rust.
CVE-2024-42304 — crash from undocumented function parameter invariants
CVE-2024-0775 — use-after-free
CVE-2023-2513 — use-after-free
CVE-2023-1252 — use-after-free
CVE-2020-14314 — out of bounds read
CVE-2019-19447 — use-after-free
CVE-2018-10879 — use-after-free
CVE-2018-10881 — out of bounds read
CVE-2014-8086 — race condition
CVE-2009-0748 — null pointer dereferenceDude, three CVEs were enough. Stop kicking the blood puddle.
crash from undocumented function parameter invariants
My favourite, as that was the exact point the dev was making in his talk, that the stuff is badly documented and that the function signature would document it perfectly.
My favorite, as that is the exact point made by anti-rust people.
What kind of type signature would prove the first block of any directory in an ext4 filesystem image isn’t a hole?
The first directory block is a hole. But type == DIRENT, so no error is reported. After that, we get a directory block without ‘.’ and ‘…’ but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash
The problem isn’t that the block is a hole. It’s that the downstream function expects the directory block to contain
.and.., and it gets given one without because of incorrect error handling.You can encode the invariant of “has dot and dot dot” using a refinement type and smart constructor. The refined type would be a directory block with a guarantee it meets that invariant, and an instance of it could only be created through a function that validates the invariant. If the invariant is met, you get the refined type. If it isn’t, you only get an error.
This doesn’t work in C, but in languages with stricter type systems, refinement types are a huge advantage.
Wouldn’t it still crash when the smart constructor was called?
If it were poorly designed and used exceptions, yes. The correct way to design smart constructors is to not actually use a constructor directly but instead use a static method that forces the caller to handle both cases (or explicitly ignore the failure case). The static method would have a return type that either indicates “success and here’s the refined type” or “error and this is why.”
In Rust terminology, that would be a
Result<T, Error>.For Go, it would be
(*RefinedType, error)(where dereferencing the first value without checking it would be at your own peril).C++ would look similar to Rust, but it doesn’t come as part of the standard library last I checked.
C doesn’t have the language-level features to be able to do this. You can’t make a refined type that’s accessible as a type while also making it impossible to construct arbitrarily.
You can do that in C, too.
What kind of type signature would prove the first block of any directory in an ext4 filesystem image isn’t a hole?
I don’t know if the type system proves it’s not a hole, but the type system certainly seems to force consumers to contend with the possibility by surfacing the outcomes at the type system level. That’s what the
Eitheris doing in the example’s return type, is it not?fn get_or_create_inode( &self, ino: Ino ) -> Result<Either<ARef<Inode<T>>, inode::New<T>>>
No intention of validating that behavior, it’s uncalled for and childish, but I think there is another bit of “nontechnical nonsense” on the opposite side of this annoying religious war: the RIIR crowd. Longstanding C projects (sometimes even projects written in dynamic languages…?) get people that know very little about the project, or at least have never contributed, asking for it to be rewritten or refactored in Rust and it’s likely just as tiring as the defensive C people when you want to include Rust in the kernel.
People need to chill out on both sides of this weird religious war; a programming language is just a tool.
That is the most sensible look into this so far.
I imagine this mentality is frustrating because of how many times they have to explain that they weren’t forcing people to learn Rust and that the Rust bindings were second class citizens. They never said to rewrite the kernel in Rust.
That’s disengenuous though.
-
We’re not forcing you to learn rust. We’ll just place code in your security critical project in a language you don’t know.
-
Rust is a second class citizen, but we feel rust is the superior language and all code should eventually benefit from it’s memory safety.
-
We’re not suggesting that code needs to be rewritten in rust, but the Linux kernel development must internalise the need for memory safe languages.
No other language community does what the rust community does. Haskellers don’t go to the Emacs project and say “We’d like to write Emacs modules, but we think Haskell is a much nicer and safer functional language than Lisp, so how about we add the capability of using Haskell and Lisp?”. Pythonistas didn’t add Python support to Rails along side Ruby.
Rusties seem to want to convert everyone by Trojan horsing their way into communities. It’s extremely damaging, both to those communities and to rust itself.
It doesn’t help that the Rust community tends to bring extremely divisive politics with it in places and ways that just don’t need to happen, starting battles that aren’t even tangentially related to programming.
-
Agreed. His experience might be useful if he were there to engage, but he’s clearly not. It seems like he just wanted to shout down the project and it seems like he was somewhat successful.
Who is Ted Ts’ in this context?
He’s the guy you hear vexing rust in the video posted. While both languages have their pros and cons, he chooses to just blast this other guy by repeating the same crap over and over without letting him reply. Basically the kind of person with a “I win because I’m louder” demeanor.
I am no visionary but if Linux doesn’t internalize this, I’m afraid some other kernel will do to it what it did to Unix.
Maybe that’s not a bad thing? If you ask me the GNU people are missing a trick. Perhaps if they rewrote Hurd in Rust they could finally shed that “/Linux”.
GNU isn’t punchy though; as soon as any punchy word get’s associated with them, people will use that word instead, and we’ll just get GNU/Thermite or GNU/Abson or something.
Easy, GNU->GUN
Gun! Unix? Not!
Are the version numbers going to be mm or caliber?
Gotta be mm to make sense unfortunately, Linux-GUN 7.62.11
They will write kernel in Ada
There’s always going to be pushback on new ideas. He’s basically asking people questions like “Hey how does your thing work? I want to write it in rust.” and gets the answer “I’m not going to learn rust.”.
I think rust is generally a good thing and with a good amount of tests to enforce behavior it’s possible to a functionally equivalent copy of the current code with no memory issues in future maintenance of it. Rewriting things in rust will also force people to clarify the behavior and all possible theoretical paths a software can take.
I’m not gonna lie though, if I would have worked on software for 20 years and people would introduce component that’s written in another language my first reaction would be “this feels like a bad idea and doesn’t seem necessary”.
I really hope that the kernel starts taking rust seriously, it’s a great tool and I think it’s way easier to write correct code in rust than C. C is simple but lacks the guardrails of modern languages which rust has.
The process of moving to rust is happening but it’s going to take a really long time. It’s a timescale current maintainers don’t really need to worry about since they’ll be retired anyway.
I apologize if this is more nontechnical nonsense as Im not a coder, but if the projects are open source, cant he just read and translate the code?
For the same reason spoken languages often have semantic structures that make a literal translation often cumbersome and incorrect, translating nontrivial code from one language into another without being a near expert in both langauges, as well as being an expert in the project in question, can lead to differences in behaviour varying from “it crashes and takes down the OS with it”, to “it performs worse”.
I’ll add that even when you’re an expert in both languages, it’s common to see WTF’s in the original and not be sure if something is a bug or just weird behavior that’s now expected. Especially when going from a looser to a more strict language.
I’ve translated huge projects and most of the risk is in “you know the original would do the wrong thing in these x circumstances – I’m pretty sure that’s not on purpose but… Maybe? Or maybe now someone depends on it being wrong like this?”
Even if you wrote the code yourself you can come back to it a while later and have a wtf moment ¯\_(ツ)_/¯
Also, even if you think it’s a bug it might be a feature that other people use and “fixing” changing it might break systems.
From a developer standpoint you’re taking someone’s baby, cloning it into a language they don’t understand and deprecating the original. Worse, if you’re not actually interested in taking over the project you’ve now made it abandonware because the original developer lost heart and the person looking for commit counts on GitHub has moved on.
Obviously these extremes don’t always apply, but a lot of open source relies on people taking a personal interest. If you destroy that, you might just destroy the project.
This is a little off topic and admittedly an oversimplification, but people saying Rust’s memory safety isn’t a big deal remind me of people saying static typing isn’t a big deal.
Totally
old white man scared of losing their jobs or their commits going insigificant…who cares. Lets move on.
the guy speaking off camera in the linked 3min 30s of the video is Ted Ts’o, according to this report about the session.
Losing their jobs? Uh what?
Lemmy comment not mentioning the race of someone challenge (IMPOSSIBLE)
I feel like the time to hide information behind YouTube links is over. Feels like a link to a paywall article at this point.
The video attached is a perfect example of the kind of “I’m not prepared to learn anything new so everyone else is wrong” attitude that is eating away at Linux like a cancer.
If memory safety isn’t adopted into the kernel, and C fanaticism discarded, Linux will face the same fate as the kernels it once replaced. Does the Linux foundation want to drag its heels and stuff millions into AI ventures whilst sysadmins quietly shift to new kernels that offer memory safety, or does it want to be part of that future?
If Linux gets rewritten in Rust it will be a new kernel, not Linux. You can make new kernels, even in Rust but they aren’t Linux. You can advertise them at Linux conferences but you can’t force every Linux dev to work on your new Rust kernel.
the crew on the Ship of Theseus would like a word with you. Because if you strip out every subsystem and replace them with a different language, everyone would still call it Linux and it would still work as Linux.
Linux isn’t “a bunch of C code” it’s an API, an ABI, and a bunch of drivers bundled into a monorepo.
Linux is a development ecosystem. If everyone agrees to switch to Rust it can switch to Rust with continuity. But they won’t.
Nobody is proposing rewriting the whole kernel in Rust.
Isn’t Linux still Linux even though probably a lot of the original code is gone? Why would slowly rewriting it whole, or just parts, in Rust make it stop being Linux?
Isn’t Linux still Linux even though probably a lot of the original code is gone?
The Kernel of Theseus.
Indeed :)
Ship of Theseus
There is no “your” new rust kernel. There is a gigantic ship of Theseus that is the Linux kernel, and many parts of it are being rewritten, refactored, removed an added all the time by god knows how many different people. Some of those things will be done in rust.
Can we stop reacting to this the way conservatives react to gay people? Just let some rust exist. Nobody is forcing everyone to be gay, and nobody is forcing everybody to immediately abandon C and rewrite everything in rust.
Linux is whatever the Linux Mark Institute says it is.
Is a single line of code in the kernel completely unchanged since its birth?
RUST ppl feel like ARCH ppl. yes it might be better than some other setup yadda yadda, but they are so enervating.i’d rather switch back to windows11 than read another post/blog on how som crustians replaced this or that c library. just shut up already.
Arch people tell you “I use arch BTW”
Rust people make PRs rewriting your code in rust.
Rust people are worse.
The sad thing is, there are other languages better at replacing C/C++ due to closer resemblance, except they’re rarely used due to lack of trendy technology that is being hyped in Rust. D lost a lot of ground due to its maintainers didn’t make it an “immutable by default” language at the time when functional programming paradigm was the next big thing in programming (which D can still do, as long as you’re not too fussy about using
consteverywhere).It was never about replacing C with a new language for the sake of novelty, it was about solving the large majority of security vulnerabilities that are inherent in memory-unsafe languages.
If Rust were to implode tomorrow, some other memory-safe language would come along and become equally annoying to developers who think they’re the first and only person to suggest just checking the code really hard for memory issues before merge.
if you were right they’d replace it with Java.
Rust’s memory safety is at compile-time. Java relies on a virtual machine and garbage collector. Nothing wrong with that approach but there’s a reason Rust is used in kernels and Java is used in userspace apps.
Who was the guy that had a lot of pauses with mmmmmm when talking?
The comments from that article are some of the most vitriolic I’ve ever seen on a technical issue. Goes to prove the maintainer’s point though.
Some are good for a laugh though, like assertions that Rust in the kernel is a Microsoft sabotage op or LLVM is for grifters and thieves.
People are dumb as hell, it’s fucking open source, go maintain the c fork, and let the those who want to improve the fucking shit cve producing codebase make a rust fork. And see which one people will use, and we all know that the rust fork will have wider adoption, it’s a no brainer.
No one is forcing them to maintain the Linux kernel, no one is telling them to stop writing patches, they can’t because you can download the code and work on it as you like.
It’s people who know they will be irrelevant because they spent decades producing shit software, and they can’t even be bothered to learn a new language to improve stability and security for the whole fucking userbase. Give me a break, what a bunch of whiners.
Nobody can maintan a fork of the linux kernel on their own or even with a team. It’s a HUGE task.
There already is rust in part of the linux kernel. It’s not a fork.
But I agree with your first statement, people are dumb as hell, me included lol
No shit
It’s people who know they will be irrelevant because they spent decades producing shit software
So the Linux kernel is shit software now? Just because it’s not written in the newest programming language? Kind of a hot take.
No because it is buggy and have a bunch of security flaws.
This is such a dumb take. For as much as I’d like to have a safer language in the kernel you need the current developers, the “big heads” at least because they have a lot of niche knowledge about their domains and how they implementation works (regardless of language) People shouldn’t take shit like this from the ext4 developer, but it doesn’t mean we should start vilifying all of them.
This guy’s concerns are real and valid but were expressed with the maturity of a lunatic child, but they are not all like this.
Yes and the big heads in this case don’t want to share that knowledge, because why? Because they are treating the kernel like their pet project that they own and control, and they don’t wanna lose that control, rather looking at the bigger picture.
It’s kinda obvious that rust is the way forward as google has clearly shown, so why are they gatekeeping?
Yes I agree but the solution for a project so big and critical is not to fork. How do you maintain all of it while at the same time adding support to Rust?
There’s no solution, they need not only to accept that rust is going to be part of the kernel but also that it’s a good thing. Otherwise how do you cooperate efficiently.
And also if they are so big brained, should be easy to learn rust then, I mean I’m pretty small brained and I know rust.
“There’s no compromise, I’M RIGHT AND YOU’RE WRONG!”
no wonder everyone hates rustphiles
What compromise? Half code should be in rust?
What does this even have to do with rust developers, The language rust gives us the ability to have more compile time checks, and why is that a bad thing. Do you like security issues in your OS because some dev forgot to handle pointers correctly?
The only compromise Rust programmers would accept is C programmers learn Rust so when they break Rust code they can fix it.
When did they refuse to share knowledge?
That was what he was talking about at the conference, he literally asked for help about how things work, so he could write better APIs that they are more comfortable using.
But the response was we don’t want to write rust.
So what’s the solution that doesn’t involve C programmers writing Rust?
There’s is no other way, C is a security issue - do you understand?
So you want to force C programmers to write Rust or GTFO.
If anything, the constant coddling of a few aging individuals within the kernel and the protection of their comforts is why Linux has been so slow to adopt technologies and paradigms that developers are begging for.
Linus complains of dev burnout starving the kernel of contributors, but the processes and technologies driving kernel development are antiquated, and the very suggestion of change is either discarded or makes you the target of a public shaming by Linus himself.
I agree with your views. But I have to give praise to Linus for bringing Rust into the kernel.
Unix -> Linux -> Ferrix?
You can’t teach old dogs new tricks.
You can, but you can’t turn a 30 year project on a dime. They’re understandably frustrated that newcomers keep coming and screaming RUST RUST RUST RUST RUST
yeah but this isn’t newcomers making noise. This is seasoned devs making meaningful contributions, and getting reactionary responses
You actually can. And it’s not that hard. I had a 14 year old German shepherd mix, who learned several new tricks before her death. I taught a partially blind 79 year old to use a computer, general internet, and email, and was communicating with her [via email] for a number of years before she lost the rest of her vision.
Old dogs, as it were, absolutely can learn new tricks.
Sorry, I just don’t like this idiom, because it puts people in a box in which they do not belong.
That’s very wholesome to hear! :) Thank you for sharing. I’m glad it’s not the case.
Many years ago at work, when PCs started to spread, I taught a 60 years old lady how to use one. She never saw a PC before yet she learned pretty well, and I saw much younger people not learning.
Being willing to learn doesn’t depend on age, it’s a mindset, either you have it or you don’t, and if you do have it, it will last your entire life.
My grandpa taught himself to text when he was 89. He just wrote a translation table:
A = 2
B = 22
C = 222
D = 3
…
