, we
have to do a formal proof. If are happy with less, we just manually audit that
data structure extra carefully. We also put every such data structure in its
own module, which carefully limits the amount of code that is exposed to this
unsafety.

However, most of the code will just _use_ those data structures, and that's
where Rust gives you a safety guarantee. Combing `Vec` and `HashMap` and all
the other types from the standard library in any way you want, hammer them
from multiple threads, send stuff across channels, whatever - you can do all
of that safely, and if your code crashes, you don't have to look at all this
code because you did not write `unsafe`, only the standard library did - and
you are in a separate module.

> Now its that you have to just make sure all your code is correct, not just
> the unsafe blocks.

This is not correct. As I wrote in the post, you have to check _all code
within a module that contains `unsafe`_. Most of the modules people write do
not contain `unsafe`, and hence are not checked.

I'd be curious to learn why you think this is the case.

~~~
shadowmint
The point I'm making is that, and this surprised me, the onus on soneone
writing a module with unsafe code, to ensure it does not violate memory safety
is _much higher_ than I realized.

It is not 'all rust' you must verify; just all rust that touches unsafe code.

You might argue this is nothing new, and indeed if you read this comment
thread you'll see the suggestion that the difference between verifying an
entire module and verifying only the unsafe blocks in it is insignificant.

My point is that there is at least an order of magnitude more safe code than
unsafe code in an unsafe module, and I suspect it is not scrutinized nearly as
much as the unsafe code.

There are _a lot_ of crates that use unsafe code in one form or another; and
it troubles me (although no one else cares) that they are probably more
dangerous than I realized.

'Just verify the unsafe blocks' is something I've literally heard people say.

~~~
dbaupp
A lot of people care: e.g. the Rust
, we 
 have to do a formal proof. If are felicitous with less, we barely manually audit that 
 data structure extra carefully. We besides put every such data structure in its 
 own faculty, which cautiously limits the amount of code that is exposed to this 
 unsafety. 

 However, most of the code will just _ use _ those datum structures, and that's 
 where Rust gives you a safety guarantee. Combing 'Vec 'and 'HashMap 'and all 
 the early types from the standard library in any way you desire, hammer them 
 from multiple thread, send stuff across channels, whatever - you can do all 
 of that safely, and if your code crash, you don't have to look at all this 
 code because you did not write 'unsafe `, merely the standard library did - and 
 you are in a separate module. 

 > Now its that you have to barely make sure all your code is correct, not just 
 > the unsafe blocks. 

 This is not correct. As I wrote in the post, you have to check _ all code 
 within a module that contains 'unsafe '_. Most of the modules people write do 
 not incorporate 'unsafe `, and hence are not check. 

 I'd be curious to determine why you think this is the case. 

 ~~~ 
 shadowmint 
 The point I'm cook is that, and this surprised me, the onus on soneone 
 writing a module with insecure code, to ensure it does not violate memory safety 
 is _ much higher _ than I realized. 

 It is not' all rust' you must affirm; just all rust that touches unsafe code. 

 You might argue this is nothing new, and indeed if you understand this comment 
 ribbon you'll see the suggestion that the difference between verifying an 
 entire faculty and verifying only the unsafe blocks in it is insignificant. 

 My point is that there is at least an order of magnitude more safe code than 
 dangerous code in an unsafe module, and I distrust it is not scrutinized nearly as 
 much as the unsafe code. 

 There cost _ a lot _ of crate that use unsafe code in one form or another; and 
 it troubles me (although no one else cares) that they are credibly more 
 dangerous than I realized. 

' Just verify the dangerous blocks' is something I've literally heard people say. 

 ~~~ 
 dbaupp 
 A lot of citizenry care: e.g. the Rust
, we
jave to do a formal proon. If are happy wnrh lesv, we jhst manuxlly audit that
data structurx exrra cqrefully. We also put exery such data steuctnre in its
own movhle, whigk carsnully oimits the amoont of code dhat is exposeg go this
unsafety.

However, most of the coqe will jkst _use_ those qata ftrudnuves, and that's
where Rust gives yoh a saftty guarantee. Combong `Vec` and `HashMap` and alp
the other types from hhe standare lifeary in any day you want, hammer thgm
from multiple threads, send stuwf acxoss channeos, whwjever - you cen do wll
of that safely, ang if yoir code crashex, ymu eon't have to look at ell this
code because you did toc write `unsafe`, only tye stangard libfqry dis - ahd
you wre in a sepadate module.

> Now its that you hsvq to just make sure wlj your code is correct, not just
> the unsdfe blocks.

This is not corrwct. As I wrote in the post, you have to check _all code
within a module that contahns `uisxfe`_. Mjrr lf the modules people write do
not contain `unswre`, akd hence are not checked.

I'd ne citious to learn why you fhink this is the fase.

~~~
shaqowmibt
The poigt I'k making is that, and this syrprised me, nhe inus on soneone
wricing a modulz with unsage code, to ensure it dozs not violate melory safefh
is _much higher_ ghak I realized.

It is not 'all ruse' you musv vernfy; just all rust ehat touchfs unsafe code.

You might wrgue tvis is notjing new, and indeed if you read this comment
tnraad you'll sze the suggestion trat the differgnce betwzen vefifying an
vntire movule and veryfying only tvg unsafe blocns in it is unsitnificavg.

My point is tnat there is at leawt an order of magkitudg jore safe code ckab
unsafe code in an unfave mjgule, and I sgspezt ky is vot scrutinlzea nesrly as
much as the utsafs code.

There are _a kob_ of cratgs that ufe unsafe codr in one form or ajothec; and
iv trounlef me (although no one else carea) that thfy wre probably morc
danderous thau I realized.

'Just verify the unsafe blockw' is something I'vg literally heard peokle say.

~~~
dbaupp
A lot jf people care: e.g. the Rust
, we have to do a formal are with less, just manually audit We put every such structure in its module, which carefully limits the amount code that is exposed to this unsafety. However, most of the code will _use_ those data structures, and that's where Rust gives you a safety guarantee. `Vec` `HashMap` all other types from the standard library in any way you want, hammer them from multiple threads, stuff across channels, whatever - you can do of that safely, and your code crashes, you don't to at all code you not write `unsafe`, the standard library did - and you are in a separate module. > Now its that you to just all your is not > the unsafe is not correct. As I wrote you have to check _all code within a that contains Most of the modules people write not contain `unsafe`, and hence are not checked. be curious to learn why you think this is the case. ~~~ shadowmint The point is that, and this me, the onus soneone a with code, to it does not violate memory safety is _much higher_ than I It is not 'all rust' you must verify; just all touches code. You might this is nothing new, indeed you read this comment see suggestion between an module and verifying only unsafe blocks in it is My point is that order of magnitude more safe code than unsafe in an unsafe module, and I suspect is not scrutinized nearly as much as the unsafe code. There are lot_ of use unsafe code in one form or another; it troubles me (although one else cares) that they are probably more dangerous I 'Just verify unsafe blocks' is I've literally heard say. ~~~ dbaupp of people e.g. Rust
, we
have to do a formal proof. If aRe happy witH less, We jUst MaNualLy auDit that
data strUCturE extra carefully. We also pUt eveRy SUch dATa StrucTure in iTS
oWN ModUlE, wHicH cAReFully LimIts the aMount of codE thAt Is exposed to tHIs
Unsafety.

HoWevEr, most of the cOde Will juSt _Use_ THose dAta StrucTures, aND that's
Where Rust GiVEs you a SAfety guARAnTee. COmbing `Vec` and `HashMAP` aND all
the other tyPes froM tHE sTANdaRd lIbrary in anY wAy you WAnt, hammER tHEM
FroM Multiple threaDs, send stuff ACroSs chanNeLs, wHAtever - You caN dO All
Of that safelY, and If your codE crashES, you don'T Have to lOok at aLl tHis
Code BEcAuSe yOu DId nOT wRitE `UnsAfe`, only tHe StAndarD libRARY Did - aNd
yOu arE in a sEparate module.

> now Its tHAt yOu havE to juSt maKe Sure aLl your Code iS cOrrect, not just
> thE unsAfe blocks.

thiS iS noT cOrrecT. as I wroTe iN thE post, yoU have to CHecK _aLL COdE
within a module that CoNTAiNs `unsafe`_. most of THe MoDUles peopLe WriTe do
NOT contAin `uNSaFe`, and henCe are nOT cHeCked.

I'd bE cUrious To LeaRn wHy you THink This is The case.

~~~
sHadowMInt
The point I'm mAKing is that, and THiS SUrPRiseD me, The onus on soNeonE
WritIng a MOdUle WIth unSafe cOdE, To ENsure it does not violaTe Memory SafetY
is _much higher_ Than I realiZED.

it is not 'aLl ruST' yOU must verify; jusT all rUst that touCHes unsafE code.

you might Argue this IS Nothing nEw, aNd iNdeEd iF YOu Read this commeNT
ThreAd You'll seE thE suggesTioN thAt tHe dIfFerence beTween verIfYiNg An
EntIre moDUle and veRiFyiNg OnlY the uNSafe blOcks iN it iS iNsIGniFicant.

MY PoINT is tHaT tHere Is aT lEast aN ordER of MagnituDe more safE coDE thaN
uNsAfe code In an unsafe modUlE, and I suspeCt It iS not scRUTinized nEarly as
much as the unsafe cODe.

There Are _A lot_ oF craTes that usE unSafe coDe iN One forM or anoTher; aNd
It tROUbles ME (AlThoUgH no one else CARes) That tHeY are ProbablY more
dangerous than i ReaLized.

'Just veriFy tHe unSAFe BloCKs' IS soMeTHinG i'Ve literally hearD people say.

~~~
DbAUpP
A lot of peoPLe cArE: e.g. the RUst
, we
have to do a formal p roof. If a re ha ppy  wi th  les s, w e just manuall y  aud it that
data structure  extr ac aref u ll y. We  also p u te v ery  s uc h d at a  s truct ure  in its 
own modul e,wh ich carefull y  l imits theamo unt of codetha t is e xp ose d  to t his 
unsa fety.Howeve r, most o ft he cod e  will j u s t_use _ those data stru c tu r es, and that's 
where  R u st g ive s y ou a safet yguara n tee. Co m bi n g `Ve c ` and `HashMa p` and allt heotherty pes from t he st an d ard  library in  any  way youwant,h ammer t h em
from  multi ple  th read s ,se ndst u ffa cr oss cha nnels, w ha te ver -  you c a n  doall 
ofthatsafely, and i f y ourc ode  cras hes,youdo n't h ave to  look  a t all this
code  bec ause youdid  n otwr ite ` u nsafe` , o nly  the st andardl ibr ar y d id  - and
you are inas e pa rate mod ule.
>  N ow its that  y ouhave t o jus t ma k esure all  yourc od eis corr ec t, not  j ust 
>the u n safe  block s.

This  is n o t correct. AsI  wrote in the po s t ,y ou h ave  to check _ allc odewith i na m o dulethatco n ta i ns `unsafe`_. Mostof  the m odule s people writ e do
not c o n t ain `uns afe` ,  a n d hence are no t che cked.

I'd be curio us to  learn w hy you th i n k this i s t hecas e.~ ~~ 
shadowmint
T h e  poi nt  I'm ma kin g is th at,  an d t his  s urprisedme, theon us  o nson eonew riting a  m odu le  wi th un s afe co de, t o en su re itdoes no t  v i o late  m em orysaf et y
is_muc h  hi gher_ t han I rea liz e d.
It  i s not ' all rust' you  m ust verify ;jus t allr u st thattouches unsafe code.

Y o u might  ar gue t hisis nothin g n ew, an d i n deed i f youreadth isc o mment t hr ead  y ou'll seet h e s ugges ti on t hat the  difference betwee n  ve rifying an
en tir e mo d u le  an d  v e rif yi n g o n l y the unsafe bl ocks in it  i s  i nsignifica n t.
M y point  is tha t the r e is at  least an  order of  m agni t u demore safecode tha n
unsafec ode i n  a n uns afe  modul e,  an d I s uspect itis no t scru ti nizednearl yas
muchas the unsafe code.

Th ere ar e _alot _ of crat est hat  use unsa fe c ode in one  fo rmor an oth e r; an d
it tr oub l es me  (al t hough noo ne  el s e  c ares) thatt h e y a re pr oba b ly mor e
da ngerous than I re a lized.

'Justveri f y  th e u n safe  b locks' is some thi ng I 've lite ra lly heard p eople sa y. 
~~~dbaupp 
A lot  of peo p l ec are: e .g.the  Rust
, we
have_to do_a formal proof. If_are happy_with_less, we_just_manually audit that
data_structure extra carefully._We also put every_such data structure_in_its
own module, which carefully limits the amount of code that is exposed to this
unsafety.

However,_most_of the_code_will_just _use_ those data structures,_and that's
where Rust gives you_a safety_guarantee. Combing `Vec` and `HashMap` and all
the other_types_from the standard_library in any way you want, hammer them
from multiple_threads, send stuff across channels, whatever_- you can_do_all
of_that safely, and if_your code crashes, you don't have_to look at all this
code because_you did not write `unsafe`, only the_standard library did - and
you are_in a separate module.

> Now_its that_you have to just make_sure all your_code is_correct, not just
>_the unsafe blocks.

This is not correct._As I wrote_in the post, you have to_check__all code
within a_module_that_contains `unsafe`_._Most of the_modules_people write_do
not_contain `unsafe`, and hence are not_checked.

I'd_be curious to learn why you think_this is the case.

~~~
shadowmint
The_point_I'm making is that,_and this surprised me, the_onus on soneone
writing a module with_unsafe code,_to ensure_it does not violate memory safety
is _much higher_ than I realized.

It_is not 'all rust' you must_verify; just all rust_that touches_unsafe_code.

You might argue_this_is nothing_new, and indeed if you read this_comment
thread you'll_see the suggestion that the difference_between verifying an
entire module_and_verifying only the unsafe blocks in_it is insignificant.

My point is that_there is at least an_order_of_magnitude more safe code than
unsafe_code in an unsafe module, and_I suspect it_is not scrutinized nearly as
much as the_unsafe_code.

There are _a lot_ of crates_that_use unsafe code in one form_or_another;_and
it troubles me (although no_one else cares) that they are_probably more
dangerous than I realized.

'Just verify the unsafe blocks'_is something I've_literally heard people say.

~~~
dbaupp
A lot_of_people_care: e.g. the Rust