Pre-PEP: Rust for CPython
discuss.python.orgI'm really not looking forward to another week long round of Rust discourse from people rubbernecking on the proposal.
To get the first few points I expect to be raised on every thread that links to the proposal:
- it is a proposal by people who work on Python that would want to leverage Rust, not Rust people imposing on Python
- it is a proposal, doesn't mean it will get adopted, let the team discuss amongst themselves
- as called out in the proposal, official Rust platform support covers official Python platform support already
Interesting proposal, but with severe risks: becoming dependent on a single specific compiler and rustc could include malicious code that isn’t obvious to an outside auditor. See https://aeb.win.tue.nl/linux/hh/thompson/trust.html Ken Thompson demonstrated this.
But what will the future of RustPython be? https://github.com/RustPython/RustPython/
Major shifts like this are complex, not so only from a technical perspective but even more because a lot of humans with different opinions are involved. But radical changes are sometimes needed to be innovative again.
> and rustc could include malicious code that isn’t obvious to an outside auditor.
I believe mrustc [0] is generally considered the current defense against a trusting trust attack, and IIRC it has verified the lack of such an attack up to rustc 1.74, which is the latest version it currently supports. Presumably whenever gccrs comes online that will be yet another defensive layer.
Upvoting for visibility. Yet, why am I not surprised? In the immortal words of Claude Rains (modified): them are the usual suspects.
I had the same reaction as most people when seeing the usual RIR,however Guido is also on the comments voting for it going forward, so there is that.
Why do people hate C?
"A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to--they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980 language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law."
-- C.A.R Hoare's "The 1980 ACM Turing Award Lecture"
Guess what 1980's language he is referring to.
Then in 1988,
For the same reason we don't commute on horses anymore.
And safety.
What makes you think this has anything to do with hating C?
"CPython has historically encountered numerous bugs and crashes due to invalid memory accesses. We believe that introducing Rust into CPython would reduce the number of such issues by disallowing invalid memory accesses by construction. While there will necessarily be some unsafe operations interacting with CPython’s C API to begin with, implementing the core module logic in safe Rust would greatly reduce the amount of code which could potentially be unsafe."