I don't think that casting a range of bits as some other arbitrary type "is a bug nobody sees coming".
C++ compilers also warn you that this is likely an issue and will fail to compile if configured to do so. But it will let you do it if you really want to.
That's why I love C++
That's not what I meant. I understand that rust forces things to be more secure. It's not not like there's some guarantee that rust is automatically safe, and C++ is automatically unsafe.
I want you to imagine that your comments in this thread were written by an engineer or a surgeon instead of a programmer.
Imagine an engineer saying "Sure, you can calculate the strength of a bridge design based on known material properties and prove that it can hold the design weight, it that doesn't automatically mean that the design will be safer than one where you don't do that". Or "why should I have to prove that my design is safe when the materials could be defective and cause a collapse anyway?"
Or a surgeon saying "just because you can use a checklist to prove that all your tools are accounted for and you didn't leave anything inside the patient's body doesn't mean that you're going to automatically leave something in there if you don't have a checklist". Or "washing your hands isn't a guarantee that the patient isn't going to get an infection, they could get infected some other way too".
A doctor or engineer acting like this would get them fired, sued, and maybe even criminally prosecuted, in that order. This is not the mentality of a professional, and it is something that programming as a profession needs to grow out of.
Every single doctor should know this yes.
It seems people are adding a sentence I didn't say "rust can be unsafe and thus we shouldn't try" on top of the one I did say "programmers should be aware that rust doesn't automatically mean safe".
You didn't say "programmers should be aware that rust doesn’t automatically mean safe". You said:
You then went on to mention
unsafe, conflating "security" and "safety"; Rust's guarantees are around safety, not security, so it sounds like you really mean "more safe" here. But Rust does make software more safe than C++: it prohibits memory safety issues that are permitted by C++.You then acknowledged:
...which seems to be the opposite of your original statement that Rust doesn't make software "more secure". But in the same comment:
...well, no, there IS a guarantee that Rust is "automatically" (memory) safe, and to violate that safety, your program must either explicitly opt out of that "automatic" guarantee (using
unsafe) or exploit (intentionally or not) a compiler bug.This is also true! "Safety" is a property of proofs: it means that a specific undesirable thing cannot happen. The C++ compiler doesn't provide safety properties[1]. The opposite of "safety" is "liveness", meaning that some desirable thing does happen, and C++ does arguably provide certain liveness properties, in particular RAII, which guarantees that destructors will be called when leaving a call-stack frame.
[1] This is probably over-broad, but I can't think of any safety properties C++ the language does provide. You can enforce your own safety properties in library code, and the standard library provides some; for instance, mutexes have safety guarantees.