Capability — memory

Memory safety

The language makes it impossible to read or write memory you do not own.

Most large software failures are not logic errors; they are memory errors — a pointer past the end of a buffer, a reference to something already freed, a type confused with another. C leaves all three to the programmer, and the industry has spent fifty years paying for it in security advisories.

The response has been to move the check earlier. Ada’s runtime checks caught overflow and range errors at the point of the mistake. ML’s type system made most of them unrepresentable. Rust went furthest, making the borrow checker prove at compile time that no reference outlives its owner — which is why it can offer the performance of C without the ownership bugs of C.

The trade-off

Safety costs either runtime checks, a proof obligation, or both — the bill always arrives, it just moves off the programmer.
Rust’s borrow checker is the strictest form yet: it rejects programs that are in fact safe, and the learning curve is famously the price of admission.

Where it came from

ML, in the 1980s, for proof assistants — then Ada for safety-critical systems in 1983, then Rust in 2015 for everything else.

in practicerust

let ships = vec!["perch", "sundial"];
let first = &ships[0];

// ships.push("graymail");
// error: cannot borrow as mutable while
//        borrowed as immutable — the compiler
//        proves the use-after-free cannot happen

Who carries it

canonical 10

present 11

partial 8