 improvement on any other language?

If the burden of'safety' is formal proof of _the entire module_, then you're
(surely) no better off than using C++ and doing exactly the same thing.

I mean, obviously the borrow checker can help to some extent, but what you're
basically saying is that it's not enough; you can't trust the borrow checker
for safety; you _must_ formally verify a module in order to know it's safe, if
it contains any unsafe code.

In other words, if your rust program has _any module_ in _any dependency_ that
has unsafe code (ie. every rust program), it is potentially unsafe, regardless
of the borrow checker (because some code path may invoke a'safe' function
that has not be formally verified to be safe, and results in undefined
behaviour despite being safe).

That's quite a troubling conclusion.

~~~
dbaupp
I'm not really sure what the problem is here: having to formally verify a
module doesn't seem fundamentally different to formally verify a single
function. I mean, sure, it's some more code, but there's still well-defined
containment. And, being "allowed" to reason about a whole module (well,
usually one just cares about a whole type, but these often match, especially
for unsafe code) seems far more useful: one can build far more interesting
abstractions. If one was forced to reason about a single function at a time,
Vec couldn't exist in a useful way, as every function would have to assume the
incoming Vec value could be arbitrarily invalid.

In any case, there are many many modules with no `unsafe` code, e.g.
std::option has none [1], iron::response has none [2], image::jpeg has none
[3] (just some random examples). These are automatically safe, if you assume
that that the code they call is safe, which seems to me like the only
assumption that can make sense: if the safe modules call unsafe ones that
aren't safe... well, the problem is in the unsafe ones, not the safe ones.

What I'm trying to say is this paragraph doesn't seem to change anything
fundamental about the objections to safe vs. unsafe you sometimes write about;
it is not introducing anything
improvement on any other language? 

 If the burden of'safety' is formal validation of _ the integral faculty _, then you're 
 (surely) no better off than using C++ and perform exactly the same matter. 

 I mean, obviously the borrow checker can help to some extent, but what you're 
 basically saying is that it's not adequate; you can't entrust the borrow checker 
 for safety; you _ must _ formally affirm a module in order to sleep together it's dependable, if 
 it contains any unsafe code. 

 In early words, if your rust platform accept _ any module _ in _ any dependency _ that 
 receive unsafe code (ie. every rust program), it is potentially unsafe, regardless 
 of the borrow checker (because some code way may invoke a'safe' routine 
 that has not be formally verified to be safe, and results in undefined 
 behavior despite being safe). 

 That's quite a troubling conclusion. 

 ~~~ 
 dbaupp 
 I'm not really sure what the problem is here: having to formally verify a 
 module doesn't seem fundamentally different to formally verify a single 
 function. I mean, sure, it's some more code, but there's still well - specify 
 containment. And, being " allowed " to reason about a solid module (well, 
 usually one just cares about a solid type, but these often match, especially 
 for insecure code) seems far more useful: one can build far more interesting 
 abstractions. If one was forced to reason about a unmarried function at a time, 
 Vec couldn't exist in a useful way, as every affair would have to bear the 
 incoming Vec value could be arbitrarily invalid. 

 In any case, there are many many modules with no 'unsafe 'code, for example 
 std::option has none [ 1 ], iron::response has none [ 2 ], image::jpeg has none 
 [ 3 ] (just some random examples). These are automatically safe, if you assume 
 that that the code they call is dependable, which seems to me like the only 
 assumption that can make sense: if the dependable modules call unsafe ones that 
 aren't dependable... well, the problem is in the unsafe one, not the safe ones. 

 What I'm try to say is this paragraph doesn't seem to change anything 
 fundamental about the objections to safe vs. unsafe you sometimes write about; 
 it is not introducing anything
 imorovement on any other lxnguage?

If the boreen of'vafety' is formxl proof of _the entire modulx_, thwn yoy're
(surely) no better ofw than uspng C++ and doiig exactly the seje thinn.

N meah, obvnonsly the borrow checker cdn help to soma dxcent, but what you're
basically saying ys that ih's not enough; iou csg't tdlsu the borrow checker
for safety; yoh _must_ hormally verify a module in order to know it's safe, if
it containd any unsafg coqw.

In other wofds, if youg rust progtam has _any module_ in _any dependdncy_ chat
has unsqfw clge (ie. every rust program), it lx potettially unsafe, regardkesv
of the borrow checker (bxcause some code patr may invmkz a'safe' function
that yaw not be xormxoly vedihies to bf sefe, and reshlts in undwfined
behaviour deskitq being safe).

Thzt's quytq a troubling conclusion.

~~~
dbaupp
I'm not redllg sure what the problem is here: having to fotmally veryfy a
module doesn't seem fundamentally different tm forjxllv veriwt w single
function. I mean, sure, it's some more coqs, nun there's still wejl-defined
comtwimient. And, beine "allocsd" to reason about a whole iodulw (well,
usuwlly one just cares about a whooe type, but nhesw often match, espeeially
for unrafe code) seems far more useful: une dan build fwr more ihgeresting
abstracgioks. Hf one was forced to reasog about a sinyle funcgion at a eime,
Vec cokldn't exist in a useful aay, ad avery funchion would have to assume the
inrpming Vec vakua cmuld be crbitrsrily invalid.

Yn any case, thgre are mcny mavy modules with nm `unsafe` coqe, e.g.
std::optiot has none [1], icon::responfe hqs nine [2], imxee::jpeg has nonr
[3] (just some random wxamples). These are aujojatically safe, ny iiu assume
that yhag tre cpdq they call iv sawe, dnich reems to me uike the only
assumption dhat can make sense: if tme safe midules cwll unsafe onrs that
aren't safe... aell, vhe prublem is in the unsafe ones, not the sare ones.

Whwt L'm trying to fay ls tris paragrcph doesn't seem to change anything
fundamxntal about the objectiins to safe vs. unsaye you sometikes wwite aboud;
it is not introducibg anything
improvement on any other language? If the is proof of entire module_, then than C++ and doing the same thing. mean, obviously the borrow checker can to some extent, but what you're basically saying is that it's not enough; can't trust the borrow checker for safety; you _must_ formally verify a module order know safe, it contains any unsafe code. In other words, if your rust program has _any module_ in dependency_ that has unsafe code (ie. every rust it is potentially unsafe, of the borrow checker (because code may invoke function has be formally verified be safe, and results in undefined behaviour despite being safe). That's quite a troubling conclusion. ~~~ dbaupp not really the problem here: to verify a module fundamentally different to formally verify a mean, sure, it's some more code, but there's well-defined containment. being "allowed" to reason about a module (well, usually one just cares about a type, but these often match, especially for unsafe code) seems far more useful: one can more interesting abstractions. If was forced to about single at time, Vec exist in a useful way, as every function would have to the incoming Vec value could be arbitrarily invalid. In any are many modules with `unsafe` code, e.g. std::option none iron::response has none [2], none (just These automatically if you assume that the code they call is which seems to me can make sense: if the safe modules call ones that aren't safe... well, the problem in the unsafe ones, not the safe ones. What I'm trying to is this seem to change anything fundamental about the objections safe vs. unsafe you write about; it is not introducing anything
 improvement on any other langUage?

If the bUrden Of'sAfeTy' Is foRmal Proof of _the entiRE modUle_, then you're
(surely) no beTter oFf THan uSInG C++ and Doing exACtLY The SaMe ThiNg.

i MeAn, obvIouSly the bOrrow checkEr cAn Help to some exTEnT, but what yoU're
Basically sayIng Is that It'S noT EnougH; yoU can't Trust tHE borroW checker
fOr SAfety; yOU _must_ foRMAlLy veRify a module in ordeR To KNow it's safe, if
it ContaiNs ANy UNSafE coDe.

In other wOrDs, if yOUr rust pROgRAM Has _ANy module_ in _any Dependency_ tHAt
hAs unsaFe CodE (Ie. everY rust PrOGraM), it is potentIallY unsafe, reGardleSS
of the bORrow cheCker (beCauSe sOme cODe PaTh mAy INvoKE a'SafE' FunCtion
thaT hAs Not be FormALLY VeriFieD to bE safe, And results in uNdeFineD
BehAviouR despIte bEiNg safE).

That's Quite A tRoubling conclusIon.

~~~
dBaupp
I'm noT reAlLy sUrE what THe probLem Is hEre: haviNg to forMAllY vERIFy A
module doesn't seem fUnDAMeNtally diFferenT To FoRMally verIfY a sInglE
FUnctiOn. I mEAn, Sure, it's sOme morE CoDe, But therE's Still wElL-deFinEd
conTAinmEnt. And, Being "allOwed" tO Reason about a whOLe module (well,
uSUaLLY oNE jusT caRes about a whOle tYPe, buT theSE oFteN Match, EspecIaLLy
FOr unsafe code) seems faR mOre useFul: onE can build far mOre interesTING
abstracTionS. if ONe was forced to rEason About a singLE functioN at a tIme,
Vec coUldn't exisT IN a useful Way, As eVerY fuNCTiOn would have to ASSume ThE
incomiNg VEc value CouLd bE arBitRaRily invalId.

In any cAsE, tHeRe Are Many mANy moduleS wIth No `UnsAfe` coDE, e.g.
std::OptioN has NoNe [1], IRon::ResponsE HaS NOne [2], iMaGe::Jpeg Has NoNe
[3] (jusT somE RanDom examPles). These Are AUtomAtIcAlly safE, if you assume
tHaT that the coDe TheY call iS SAfe, which Seems to me like the only
assUMption tHat Can maKe seNse: if the sAfe ModuleS caLL unsafE ones tHat
arEn'T saFE... Well, tHE PrOblEm Is in the unsAFE onEs, not ThE safE ones.

WhAt I'm trying to say is tHIs pAragraph doesn'T seEm to CHAnGe aNYtHIng
FuNDamENTal about the objeCtions to saFe VS. uNsafe you soMEtiMeS write aBout;
it iS not iNTroduciNg anythinG
 improvement on any otherlanguage?
If t hebur de n of 'saf ety' is formal proo f of _the entire modul e_, t he n  you ' re 
(sur ely) no be t t erof ftha nu si ng C+ + a nd doin g exactlythe  s ame thing.
I  m ean, obvio usl y the borrow  ch eckerca n h e lp to  so me ex tent,b ut wha t you'reba s ically sayingi s  t hatit's not enough;y ou can't trust th e borr ow ch e c ker 
fo r safety;yo u _mu s t_ form a ll y v eri f y a module in  order to k n owit's s af e,i f
it c ontai ns any  unsafe cod e.
In otherwords, if your rust pr ogramhas  _a ny m o du le _ i n_ any de pen d enc y_ thatha sunsaf e co d e ( ie.eve ry r ust p rogram), it i s p oten t ial ly un safe,  reg ar dless 
of th e bor ro w checker (beca usesome code  pa th  ma yinvok e  a'saf e'fun ction
t hat has not  b e f or mally verified tobe s af e, and r esults in  u n definedbe hav iour d espit e be i ng  safe).
That' s  q ui te a tr ou blingco ncl usi on.
~ ~~
d bauppI'm notreall y  sure what the problem is he r e: h av i ng t o f ormally ver ifya 
mod uled oe sn' t  seem  fund am e nt a lly different to fo rm ally v erify  a single
fun ction. I m e a n , sure,it's so m e more code, b ut th ere's stil l  well-de fined 
contain ment. And , being "a llo wed " t o r e a so n about a who l e  mod ul e (well ,
u suallyone  ju stcar es  about awhole ty pe ,bu tthe se of t en match ,esp ec ial ly
fo r  unsaf e cod e) s ee ms far  more u s ef u l : on eca n bu ild  f ar mo re i n ter estingabstracti ons .  Ifon ewas for ced to reason  a bout a sin gl e f unctio n at a tim e,
Vec couldn't exist i n  a usef ulway,as e very func tio n woul d h a ve toassume  thein com i n g Vec v al ueco uld be arb i t rar ily i nv alid .

In a ny case, there are man y many module s w ithn o  ` uns a fe `  co de ,  e. g . 
std::option ha s none [1] ,i ro n::respons e  ha snone [2 ], imag e::jp e g has n one
[3] ( just some  r ando m exa mples). Th ese areautomatic a lly s a fe , ifyou  assum etha t tha t thec ode  they  callis  safe,  whic hseems to  me like the only
assum ptionthatcan  make sen se: ifthe safemodu les call u nsa feonestha t 
aren 't s a fe ... well,  the problem i s  i n t h e  u nsafe ones, n o t t he sa feo nes.
What  I'm trying to sa y  is this parag raph d oes n't seem  t o change anyth ing 
f u n damental  a bout the ob jections  t o  safe  vs. u nsafeyou som e t im e s writ e ab out ;
it is n otin t roducin gan y thing
 improvement_on any_other language?

If the burden_of'safety' is_formal_proof of__the_entire module_, then_you're
(surely) no better_off than using C++_and doing exactly_the_same thing.

I mean, obviously the borrow checker can help to some extent, but what_you're
basically_saying is_that_it's_not enough; you can't trust_the borrow checker
for safety; you__must_ formally_verify a module in order to know it's_safe,_if
it contains any_unsafe code.

In other words, if your rust program has__any module_ in _any dependency_ that
has_unsafe code (ie._every_rust_program), it is potentially_unsafe, regardless
of the borrow checker (because_some code path may invoke a'safe'_function
that has not be formally verified to_be safe, and results in undefined
behaviour_despite being safe).

That's quite a_troubling conclusion.

~~~
dbaupp
I'm_not really sure what the_problem is here:_having to_formally verify a
module_doesn't seem fundamentally different to formally_verify a single
function._I mean, sure, it's some more_code,_but there's still_well-defined
containment._And,_being "allowed"_to reason about_a_whole module_(well,
usually_one just cares about a whole_type,_but these often match, especially
for unsafe code)_seems far more useful:_one_can build far more_interesting
abstractions. If one was forced_to reason about a single function_at a_time,
Vec couldn't_exist in a useful way, as every function would have to_assume the
incoming Vec value could be_arbitrarily invalid.

In any case,_there are_many_many modules with_no_`unsafe` code,_e.g.
std::option has none [1], iron::response has none_[2], image::jpeg_has none
[3] (just some random examples)._These are automatically safe,_if_you assume
that that the code they_call is safe, which seems to_me like the only
assumption that_can_make_sense: if the safe modules_call unsafe ones that
aren't safe... well,_the problem is_in the unsafe ones, not the safe_ones.

What_I'm trying to say is this_paragraph_doesn't seem to change anything
fundamental about_the_objections_to safe vs. unsafe you_sometimes write about;
it is not introducing_anything