 is not necessarily referring to a single
change, but rather the application as a whole. Dependencies like libstd are
ignored here.

As soon as there's any `unsafe` in your code, you've unlocked hard mode and
everything is probably your fault.

------
btrask
Perhaps a quick fix would be to allow variables themselves to be tagged as
unsafe, so they could only be changed from unsafe blocks.

~~~
btrask
I tried suggesting this directly on GitHub. Here was the response:

> There's an old idea of unsafe fields that would come up for datatypes. It
> can be emulated with a Unsafe<T> wrapper that has unsafe methods to get
> references to its interior, or to read/write. It's not widely used, or used
> at all afaik, since the gains aren't that great. People writing unsafe code
> generally know the issues, and that privacy is the #1 way the abstraction
> boundary is maintained.

[https://github.com/rust-
lang/rust/issues/9883#issuecomment-1...](https://github.com/rust-
lang/rust/issues/9883#issuecomment-170716254)

Privacy may be the best way to limit unsafety, but C and C++ already have
privacy.

------
catnaroek
How exactly is this notion of “semantic types” formalized? Is it something
like NuPRL, where the base language's type system isn't sufficiently precise
to rule out all misbehaviors, and on top of that a more precise type system is
added, whose typing rules might be defined in terms of the base language's
evaluation/execution rules?

------
shadowmint

        The scope of unsafe ends at the next abstraction boundary. This means that 
        everything outside of the std::vec module does not have to worry about Vec.
       ...
        Of course, this also means that everything inside std::vec is potentially 
        dangerous and needs to be proven to respect the semantics of Vec.
    

So wait, in a nutshell, a module is'safe' if and only if you formally prove
that every public interface into the module and every way that public
interface can be invoked... is error free.

How is that any
is not necessarily referring to a single 
 change, but preferably the lotion as a whole. Dependencies like libstd are 
 ignored here. 

 equally soon as there's any 'unsafe 'in your code, you've unlock hard manner and 
 everything is probably your fault. 

 ------ 
 btrask 
 possibly a immediate fix would be to admit variables themselves to be tagged as 
 dangerous, so they could merely be changed from unsafe blocks. 

 ~~~ 
 btrask 
 I tried suggesting this immediately on GitHub. Here was the response: 

 > There's an old idea of dangerous fields that would come up for datatypes. It 
 > can be emulate with a Unsafe < T > negligee that has unsafe methods to get 
 > references to its department of the interior, or to read / write. It's not widely used, or used 
 > at all afaik, since the gains aren't that great. People writing unsafe code 
 > generally know the issues, and that privacy is the # 1 way the abstraction 
 > boundary is maintained. 

 [ https://github.com/rust- 
 lang / rust / issues/9883#issuecomment-1... ](https://github.com / rust- 
 lang / rust / issues/9883#issuecomment-170716254) 

 Privacy may be the best manner to limit unsafety, but C and C++ already have 
 privacy. 

 ------ 
 catnaroek 
 How precisely is this notion of “ semantic types ” formalized? Is it something 
 like NuPRL, where the base linguistic process's type system isn't sufficiently precise 
 to rule out all misbehavior, and on top of that a more precise type system is 
 added, whose typing rules might be defined in terms of the base language's 
 evaluation / execution principle? 

 ------ 
 shadowmint 

         The setting of unsafe ends at the next abstraction boundary. This mean that 
         everything outside of the std::vec module does not have to worry about Vec. 
       ... 
         Of naturally, this also entail that everything inside std::vec is potentially 
         dangerous and needs to be proven to respect the semantics of Vec. 
    

 indeed wait, in a nutshell, a faculty is'safe' if and only if you formally prove 
 that every public interface into the module and every way that public 
 interface can be invoked... is mistake free. 

 How is that any
 is not necessarily referrikg to a single
chcbge, buv rathed the apolication as a whole. Dependeiciew likt libstd are
ignored here.

As slon as tyere'w any `unsafx` in youv cods, you're unlocked hard mode and
eeerything is psocayly your fault.

------
btrask
Perhaps a quick six woukd be to allow vwrianjes fhemselves to be tagged as
unsafe, sk they bould only be chamged from unsafe blocks.

~~~
btrwsk
I tried suggesting hhis directoy og GitHub. Here was the rts'onse:

> There'a an old idea of unsafe fields ghat could come o' fog datatypes. Mt
> can be emulated with a Gnsafe<T> wrapper that mas uisafw methods to get
> refecences to its interijr, or to secd/write. It's not widelt ysed, mr uved
> xr aul zfeik, since thx gains areh't that greqt. People writing umswde code
> generzlly kgor the issues, and that privacy is the #1 wdy fhe abstraction
> boundart is maintained.

[https://glthub.com/rtst-
lang/rust/issues/9883#issuecomment-1...](https://github.com/rust-
latg/rusv/irsuts/9883#lfryefomment-170716254)

Privacy may be the best way to limit ugaageny, but C and C++ alveady have
privacy.

------
cstjatjek
How exactli is thna hotion of “semantic types” sormaoized? Is yt spmething
like NuPRL, where thw base langucge'w type system isn't sufficientuy ptecise
yo rule out all misbehariors, znd on top lf that a oore precise typd sjstek is
added, whose typing rulqs might ue deyined in terks of ehe base lwnguana's
evaluation/executlon roles?

------
shddowmint

        The scope of unsafe ends ev the next abxtsacnion bounbary. Tmis means that 
        everytking outfide uf the std::nec modulx does not hwve to worry dhout Vec.
       ...
        Od coyrse, thkr also means tnat everynhnng insidw std::vec is potentlally 
        dangerobr and needs to br pfovqn tp waspect the samangicr of Vdc.
    

So walt, kn a nutshell, a module iv'safs' if and only if ypu formalli prove
thwt every publoc interface into uhe movule aid evety ray that public
interface can bs invoked... is error free.

Hjw iw that any
is not necessarily referring to a single rather application as whole. Dependencies like soon there's any `unsafe` your code, you've hard mode and everything is probably fault. ------ btrask Perhaps a quick fix would be to allow variables themselves be tagged as unsafe, so they could only be changed from unsafe blocks. btrask tried this on GitHub. Here was the response: > There's an old idea of unsafe fields that would up for datatypes. It > can be emulated a Unsafe<T> wrapper that unsafe methods to get > to interior, or read/write. not used, or used at all afaik, since the gains aren't that great. People writing unsafe code > generally know the and that the #1 the > is maintained. [https://github.com/rust- Privacy may be the best way but C and C++ already have privacy. ------ How exactly this notion of “semantic types” formalized? it something like NuPRL, where the base language's system isn't sufficiently precise to rule out all misbehaviors, and on top of that a type system is added, typing rules might defined terms the language's evaluation/execution ------ shadowmint The scope of unsafe ends at the next abstraction This means that everything outside of the std::vec module does to about Vec. ... course, this also means everything std::vec is potentially dangerous to proven semantics Vec. wait, in a nutshell, module is'safe' if and only you formally prove that module and every way that public interface can invoked... is error free. How is that
 is not necessarily referring To a single
cHange, But RatHeR the ApplIcation as a wholE. depeNdencies like libstd are
iGnoreD hERe.

As SOoN as thEre's any `UNsAFE` in YoUr CodE, yOU'vE unloCkeD hard moDe and
everyThiNg Is probably yoUR fAult.

------
btrask
perHaps a quick fiX woUld be tO aLloW VariaBleS themSelves TO be tagGed as
unsaFe, SO they cOUld only BE ChAngeD from unsafe blocks.

~~~
BTrASk
I tried suggesTing thIs DIrECTly On GItHub. Here wAs The reSPonse:

> ThERe'S AN Old IDea of unsafe fiElds that wouLD coMe up foR dAtaTYpes. It
> Can be EmULatEd with a UnsaFe<T> wRapper thaT has unSAfe methODs to get
> RefereNceS to Its iNTeRiOr, oR tO ReaD/WrIte. iT's nOt widely UsEd, Or useD
> at aLL AFAik, sIncE the Gains Aren't that greaT. PeOple WRitIng unSafe cOde
> gEnErallY know tHe issUeS, and that privacy Is thE #1 way the abStrAcTioN
> bOundaRY is maiNtaIneD.

[https://gIthub.coM/RusT-
lANG/RuSt/issues/9883#issuecommeNt-1...](HTTpS://github.cOm/rust-
LAnG/rUSt/issues/9883#IsSueCommENT-170716254)

PrivAcy mAY bE the best Way to lIMiT uNsafety, BuT C and C++ AlReaDy hAve
prIVacy.

------
CatnarOek
How exActly IS this notion of “sEMantic types” foRMaLIZeD? is it SomEthing
like NUPRL, WHere The bASe LanGUage's Type sYsTEm ISn't sufficiently precIsE
to rulE out aLl misbehaviorS, and on top oF THAt a more pReciSE tYPe system is
addeD, whosE typing rulES might be DefinEd in termS of the basE LAnguage's
EvaLuaTioN/exECUtIon rules?

------
shadoWMInt

        THe Scope of UnsAfe ends At tHe nExt AbsTrAction bouNdary. ThiS mEaNs ThAt 
        eVerytHIng outsiDe Of tHe Std::Vec moDUle doeS not hAve tO wOrRY abOut Vec.
       ...
        OF CoURSe, thIs AlSo meAns ThAt eveRythINg iNside stD::vec is potEntIAlly 
        DaNgErous anD needs to be proVeN to respect ThE seManticS OF Vec.
    

So waIt, in a nutshell, a module is'sAFe' if and OnlY if yoU forMally provE
thAt everY puBLic intErface Into tHe ModULE and eVERy Way ThAt public
inTERfaCe can Be InvoKed... is erRor free.

How is that anY
 is not necessarily referr ing to a s ingle 
ch ang e,  but  rat her the applic a tion  as a whole. Dependenc ies l ik e  lib s td  areignored he r e .
As  s oon  a s  t here' s a ny `uns afe` in yo urco de, you've u n lo cked hardmod e and
everyt hin g is p ro bab l y you r f ault. 

---- - -
btra sk
Perhap sa  quick fix wou l d  b e to  allow variablest he m selves to be t aggedas un s a fe,  so  they coul donlyb e chang e df r o m u n safe blocks.
~~~
btrask I t ried s ug ges t ing th is di re c tly  on GitHub.  Her e was the  respo n se:

>T here'san old  id eaof u n sa fe  fi el d s t h at  wo u ldcome upfo rdatat ypes . I t 
> c anbe e mulat ed with a Uns afe <T>w rap per t hat h as u ns afe m ethods  to g et 
> references t o it s interio r,or  to  r ead/w r ite. I t's  no t widel y used, orus e d >at all afaik, sinc et h egains ar en't t h at  g r eat. Peo pl e w riti n g  unsa fe c o de 
> gener ally k n ow  t he issu es , andth atpri vacyi s th e #1 w ay the a bstra c tion
> boundar y  is maintaine d .[ ht t ps:/ /gi thub.com/ru st-l ang/ rust / is sue s /9883 #issu ec o mm e nt-1...](https://gi th ub.com /rust -
lang/rust/i ssues/9883 # i s suecomme nt-1 7 07 1 6254)

Privacy  maybe the bes t  way tolimit  unsafet y, but Ca n d C++ al rea dyhav e
p r i va cy.

------
c a t naro ek 
How ex act ly is t his  no tio n o f“semantic  types”fo rm al iz ed?  Is i t  somethi ng 
li ke  Nu PRL,w here t he ba se l an gu a ge' s types ys t e m is n' tsuff ici en tly p reci s e
t o ruleout all m isb e havi or s,  and on  top of thatamore preci se  ty pe sys t e m is
add ed, whose typing rulesm ight be  de fined  interms ofthe  baselan g uage's 
evalu ation /e xec u t ion r u l es ?
-- ----
shado w m int 

      T he scop e of unsafe ends a t  th e next abstra cti on b o u nd ary .  T h isme a nst h at 
        eve rything ou ts i de  of the st d ::v ec  module  does n ot ha v e to wo rry about  Vec.
     .. .        Of co urse, th is also m e ans t h at  ever yth ing in si destd:: vec is pot entia lly 
      d anger ou s and ne eds to be proven to res pect t he se man tics of V ec.    

So wai t, i n a nutshe ll,  amodul e i s 'safe ' if an d o n ly if  you formallyp ro vet h at  every publ i c int erfac e i n to the  mod ule and every way that public
in terf a c e c anb e in vo ked... is erro r f re e . 

How is  t hat any
 is_not necessarily_referring to a single
change,_but rather_the_application as_a_whole. Dependencies like_libstd are
ignored here.

As_soon as there's any_`unsafe` in your_code,_you've unlocked hard mode and
everything is probably your fault.

------
btrask
Perhaps a quick fix would be_to_allow variables_themselves_to_be tagged as
unsafe, so they_could only be changed from_unsafe blocks.

~~~
btrask
I_tried suggesting this directly on GitHub. Here was_the_response:

> There's an_old idea of unsafe fields that would come up_for datatypes. It
> can be emulated_with a Unsafe<T>_wrapper_that_has unsafe methods to_get
> references to its interior, or_to read/write. It's not widely used,_or used
> at all afaik, since the_gains aren't that great. People writing_unsafe code
> generally know the_issues, and_that privacy is the #1_way the abstraction
>_boundary is_maintained.

[https://github.com/rust-
lang/rust/issues/9883#issuecomment-1...](https://github.com/rust-
lang/rust/issues/9883#issuecomment-170716254)

Privacy may be_the best way to limit unsafety,_but C and_C++ already have
privacy.

------
catnaroek
How exactly is this_notion_of “semantic types”_formalized?_Is_it something
like_NuPRL, where the_base_language's type_system_isn't sufficiently precise
to rule out all_misbehaviors,_and on top of that a more_precise type system is
added,_whose_typing rules might be_defined in terms of the_base language's
evaluation/execution rules?

------
shadowmint

   _ _ _The scope of unsafe ends at the next abstraction boundary. This_means that 
   _   _everything outside_of_the std::vec module_does_not have_to worry about Vec.
   _ _ ...
    _   Of_course,_this also means that everything inside_std::vec is potentially 
  _    _dangerous_and_needs to be proven to_respect the semantics of Vec.
 _  

So_wait, in a nutshell, a module is'safe'_if_and only if you formally prove
that_every_public interface into the module and_every_way_that public
interface can be invoked..._is error free.

How is that any