Huon Wilson

My favorite 2048 clone is 2048 4D https://huonw.github.io/2048-4D/

Yeah, of course a synchronous call that might block the thread is blocking, I agree... but, if I didn't have the context of "we're in a comment thread about a blog post about mmap", I'm pretty sure I wouldn't flag `x[i]` on `x: &[u8]` (or any other access) as a synchronous call that is worth worrying about. Hence the discussion of subtlety in https://huonw.github.io/blog/2024/08/async-hazard-mmap/#at-a-distance It's obvious when pointed out, but I don't think it's obvious without the context of "there's an mmap nearby". (Author here, this behaviour wasn't surprising to me, but felt subtle enough to be worth investigating, and get some concrete data.)

Thank you for your impeccable responses, it's one of the reasons I love hn. FWIW, I think a few explainer pieces would help bring about more enlightened discussions. For example, there is a lot of bikeshedding around Rusts' decision to wrap overflows and potential future improvements. But the rationale and interesting technical challenges each alternative brings is scattered across blog posts, forum threads, and Github issue tickets. 1: http://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-ov…

You're right, there does not appear to be a way to achieve 1. Rust arithmetic does 3. in debug builds, or something vaguely similar if requested by using the checked_* functions, and 2. in release builds, or if requested by using the wrapping_* functions, and 4. by using the saturating_* functions. Recommended reading: http://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-ov…

> I’d love to see a survey talking about what bugs get actually solved by using one of these modern languages like Rust or Swift, since i personally never once in my career had a bug that wouldn’t have happened if i used const, let alone any of the many other annoying Rust features. A quick analysis I did showed that half of the critical security vulnerabilities in Gecko would have been prevented by writing content and layout code in Rust. The other half were mostly JS issues, often having to do with built-in APIs that would also be safe if appropriately written in Rust (or self-hosted). > For a “systems programming language”, Rust doesn’t let you do anything i’d expect, like let you specify whether a signed integer is 2s compliment, and how it behaves when it wraps. Well, this definition of a systems programming language excludes C. > Instead the programmer is at the whim of the compiler writer, same as in C, and its “undefined behaviour” which is a source of real, hard to track bugs. Nope. Rust defines signed overflow. http://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-ov… > Rust doesn’t even have support for modern features like wide registers What is a "wide register"? Do you mean SIMD? If so, it sure does [1]. > or any features that help you deal with raw memory, it just marks it as “unsafe”. Sure it does. Rust helps you deal with raw memory by freeing you from the need to deal with raw memory in the vast majority of occasions.…

The previous post: [Mechanical sympathy for QR codes: making NSW check-in better](https://huonw.github.io/blog/2021/10/nsw-covid-qr).

In the "unsafe" example in Swift can you get to undefined behavior? In your "unsafe" example in Rust, you still don't get undefined behavior. https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-o…

> we get continuing bugs and vulnerabilities as a result Background reading: https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-o… If you only want safety, then trapping or not, signalling or not does not matter at all. It is UB that causes safety problems, not the overflow itself. And RISC-V mandates the overflow handling manner. No UBs. Throw on arithmetic overflow is a language choice. And at least Rust thinks that arithmetic exception everywhere is not necessary for security. The only related problem with no overflow trapping is that dynamically typed languages needs numerical type conversion on overflow. But TBH, if a numerical javascript program often generates 1.7E308, then it's a terrible program that no one should care.

The full write up shows that the exploit is based on a integer underflow that would be easily caught by Zig and any other programming language with sane runtime checks. Ironically enough this is the one class of bugs that Rust would not have prevented out of the box since the language defines integers to be wrapping and you need to manually opt into runtime checks. The exploit: https://secret.club/2021/04/20/source-engine-rce-invite.html Wrapping in Rust: https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-o… https://scattered-thoughts.net/writing/how-safe-is-zig/ I hope that explains how inappropriate is the tone of your comment.

Interestingly it seems rust only does full overflow checking in debug builds: https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-o…

The problem with memory management is a problem with lifetime management, which Rust reasons about in terms of ownership management, which it attempts to reason about statically, with help from the programmer. GC attempts to do the same thing, dynamically, with less help from the programmer. Both of those methods still allow leaks, which is why Rust encourages RAII. [1] Are there other structured lifetimes we can get compilers to enforce for us, like they enforce certain invariants about flow control using control structures? [1] https://users.rust-lang.org/t/memory-leaks-in-rust/18187/2 http://huonw.github.io/blog/2016/04/memory-leaks-are-memory-safe/ https://doc.rust-lang.org/nomicon/leaking.html

Just to add to that: Integer overflows in release builds can be turned on, and even when they are off, at very least they are not UBs. More info in http://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-ov…

Have to say that nothing can make your program automatically safe (defined by common sense, not "memory leaks are also memory safe"[0]) without any effort, and the trend to claim some languages are inherently "safe" while others are not is definitely a hype. Modern C++ plus static analyzing (Chromium rolled out their own Clang plugins to do that) provides better flexibility. [0]: http://huonw.github.io/blog/2016/04/memory-leaks-are-memory-safe/

Indeed, rr has worked with Rust since at least 2015 ( http://huonw.github.io/blog/2015/10/rreverse-debugging/ ), and I see the author of rr around the Rust community enough (I believe he works at Mozilla?) that I doubt this has regressed in the meantime.

Rust specifies that both signed and unsigned integer overflow will wrap as two’s complement. The Rust developers want to discourage overflow because it is a common source of logic bugs, but the behavior is not unsafe. https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-o…

> Graph in Rust: https://github.com/bluss/petgraph Thousands lines of code. Large amount of that is unsafe rust, even C++ is safer than that :-) > SIMD in Rust: http://huonw.github.io/blog/2015/08/simd-in-rust/ (yes, still in nightly) It was already “still in nightly” a year ago. Also it’s harder to do integer math with it, because type safety: very often, even consecutive instructions interpret these __m128i registers as different datatypes, u8x16 / i32x4 / u64x2 / etc.

Graph in Rust: https://github.com/bluss/petgraph SIMD in Rust: http://huonw.github.io/blog/2015/08/simd-in-rust/ (yes, still in nightly)

I have not had the chance to try this, but this sings high praise: http://huonw.github.io/blog/2015/10/rreverse-debugging/

SIMD support in Rust is still very early and required unsafe mode for SSE, and lepton makes heavy use of SSE intrinsics. Now I do see http://huonw.github.io/simd/simd/ was being developed in August 2015, but it seems to be gathering dust of late. I really do wish that Rust would provide nice alignment guarantees (eg 32 byte) without depending on customizing the allocator, and builtin, safe, SIMD instructions

Fwiw here's the Rust side of things (also with reference to `lea`): https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-o… tl;dr:debug mode checks for overflow and panics when it happens; release mode is defined to wrap as two's complement

For a more in-depth explanation of how Send and Sync work theoretically, see http://manishearth.github.io/blog/2015/05/30/how-rust-achieves-thread-… or http://huonw.github.io/blog/2015/02/some-notes-on-send-and-sync/

Rust has also yet to finalize SIMD, which will help a ton on some where Rust is behind. http://huonw.github.io/blog/2015/08/simd-in-rust/

Huon (dbaupp) has a nice overview: http://huonw.github.io/blog/2014/07/what-does-rusts-unsafe-mean/

People are going to hate me for bringing this up again, but this 4D version of 2048 is actually easier than the 2d version. https://huonw.github.io/2048-4D/ There's also a 3D version which I think is harder. https://joppi.github.io/2048-3D

(Disclaimer: I'm one of the authors). For decision trees, the only thing that's available at the moment is a half-baked ID3 algorithm, but I've been looking at CloudForest and it's a very impressive piece of work. Performance isn't very good yet: this is due to some data representation decisions, but it now supports grouping attributes which will allow us to optimise to acceptable performance levels (I have a prototype KNN version which achieved similar performance levels to this guy's Rust[1] implementation). [1] http://huonw.github.io/2014/06/10/knn-rust.html

the 3d one I found to be the easiest: http://joppi.github.io/2048-3D/ but 4d is terribly hard: http://huonw.github.io/2048-4D/ edit: I did a 3d victory in the 18 minutes in editing the comment. You can generally just push higher numbers into a corner, and pick either the left or the right side to consistently fold to and you'll get it mostly without thinking.

Nope! http://huonw.github.io/isrustfastyet/ It's important to track this over time to make sure regressions don't get in.

> You're conflating undefined behavior with spatial/temporal memory safety, You are correct; I should have written "memory safety". > Zig treats memory safety not as an extreme-at-all-costs but as a spectrum Zig needs to be more forthright about this. When I first heard about Zig, I googled "zig vs rust" and found an article on the Ziglang website addressing that very topic: https://ziglang.org/learn/why_zig_rust_d_cpp/ It completely fails to mention memory safety at all. That seems extremely dishonest, since memory safety is basically the "headline feature" of Rust (well, one of two or three at most). I wasted a lot of time digging through the Zig language manual ("so then how do they...") before concluding that something didn't add up. It definitely left a bad taste in my mouth. > Rust won't protect you from all undefined behavior ... Rust has checked arithmetic off by default in safe builds That didn't surprise me at all, nor will it surprise anybody who knows Java. Modular arithmetic is perfectly well-defined. It's only C/C++ that picked the crazysauce option of decreeing that signed overflow is totally equivalent to scribbling all over random pieces of memory. It isn't overflow that's a security risk; it's languages that define overflow to be undefined in order to squeeze out a few piddly loop micro-optimizations. This becomes increasingly less beneficial in languages with iterators and no backward-compatible-with-C burden. Details (scroll to "Myth:…

>As for disabling asserts in the code you ship: That is such a quaint 1980'ies thing to do, and people should have stopped doing it long time ago. Sqlite makes all its asserts noop in release mode[1]. Chrome disables DCHECK() in release mode[2], and it's used many times[3]. RE2 has debug only checking[4]. In Rust debug mode, signed integer overflow panics, in release mode it wraps[5]. Firefox disables MOZ_ASSERT() in release mode[6], and it's used many times[7]. I doubt Huawei is more modern and less 1980s than all these other projects. >My money is on Huaweis function doing the check with an assert which was compiled out for deliverable code. Are you saying it was compiled out because asserts were disabled, or because the compiler could reason about the arguments at every callsite? It seems unlikely to me that the compiler could reason about the arguments at every callsite. [1] https://www.sqlite.org/assert.html [2] https://chromium.googlesource.com/chromium/src/+/master/styleguide/c++… [3] https://cs.chromium.org/search/?q=DCHECK%5C(+case:yes&sq=package:c… [4] https://github.com/google/re2/blob/master/util/logging.h [5] http://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-ov… [6] https://dxr.mozilla.org/mozilla-central/source/mfbt/Assertions.h#378 [7] https://dxr.mozilla.org/mozilla-central/search?q=MOZ_ASSERT(&redir…