![]() |
|
![]() |
| > Makes it easier for upstream and the distro.
Until there's a vulnerability in one of the dependencies and now you have to rebuild all of the packages which use it. Specifically for Rust, there's also the fact that most projects use a lock file and if your build process respects it, you now have to wait for the upstream to update it and release a new version (or update it yourself). And if your build process doesn't respect the lock file (or the project doesn't use it) and you just fetch the latest compatible dependencies at the time of build, you now have no idea if you're affected or not by the vulnerability because you don't have the exact resolved versions stored anywhere (https://github.com/rust-lang/rfcs/pull/2801). |
![]() |
| That's the dream. I want a system that's 100% source-available, 100% reproducible, and 100% statically-defined. Nix looks like the closest thing to that right now. |
![]() |
| > The distro repositories are being continuously rebuilt, because packages are receiving continuous updates.
At large timescales, yes. But not at timescales relevant for rapid security updates. |
![]() |
| Do you know whether someone has made an estimate based on the history of actual vulnerabilities of how much rebuilding would need to be done in a non-shared library approach? |
![]() |
| > I don’t want to have to go look at which version of that library exists in 18 different Linux distributions.
If you make open source software, the solution is simply that you should not distribute your software [1]. Let distro maintainers do it, and suddenly it's a lot easier for you. If you make proprietary software, then it's not exactly the problem of the Linux distros anymore so sure, feel free to link statically. I personally think you should do a mix of both: libraries like openssl you want to link dynamically from the system. Now some obscure dependency you may have that breaks compatibility randomly and is generally not distributed by major distros, probably you want to link them statically. But you should know that you are then responsible for them and the security issues they may bring (i.e. you should monitor them and update them regularly). [1]: https://drewdevault.com/2019/12/09/Developers-shouldnt-distr... |
![]() |
| Honestly a problem is that most developers just don't understand how it works. Docker / static linking solves a lack of understanding, mostly. That's why they are popular. |
![]() |
| Some distros do actually break out rust dependencies into separate packages (e.g. Guix does this). It's just that a lot of rust software isn't distributed primarily by distros. |
![]() |
| Fedora and Debian do this too. That's why it sometimes takes longer for a project to be packaged - you literally have to recursively package all of the dependencies first. |
![]() |
| A Swift program for a particular distribution will dynamically link some system libraries from the distro, and these libs might change on every distro update. They mention in the post that dynamic linking can cause versioning issues.
> Say my Linux distribution distributes some Swift runtime That runtime would need to be compatible with the Swift program. Nowadays that’s not a big issue due to ABI stability (https://www.swift.org/blog/abi-stability-and-apple/), but this would close the door on new features that need runtime support (need an OS update then, or the OS must come with multiple runtimes). |
![]() |
| But they do. They do let you choose.
Debian's build of rust packages are linked dynanically, for instance. It's a build setting, you can turn it on. |
![]() |
| I've had a 0% success rate compiling other people's Rust apps statically. I always end up with a shared binary or a failed build, even when building with musl. |
![]() |
| I just tried this myself and I did not have a painless experience. Hah. Without the `musl` Archlinux package installed, I get this:
Notice, in particular, that there is `CC=musl-gcc` in the error above. But:
I think the spoiler here is the fact that ripgrep uses jemalloc when you build with musl on 64-bit: https://github.com/BurntSushi/ripgrep/blob/c9ebcbd8abe48c833...If you comment out those lines and remove the `jemallocator` dependency from `Cargo.toml`, then the build succeeds. I imagine you'll run into this same problem if you enable ripgrep's `pcre2` feature. However, after installing the `musl` Archlinux package (which provides `musl-gcc`, among other things of course), then the above command builds just fine. Including with `jemallocator` or even with the `pcre2` feature enabled. |
![]() |
| Interesting, I must have had musl preinstalled from some other package. And I did notice that jemallocator started showing up when I compiled for musl, I figured you must have had a good reason. :P |
![]() |
| Nothing stops you from linking against glibc statically from rust. It’s recommended to link against glibc dynamically, but that’s just as true for any language. |
![]() |
| It's a beautiful language that's a joy to write. It's safe and ergonomic, and has an extremely powerful type system. I'd say those are good reasons to use Swift. |
![]() |
| I'm really interested in exploring it for building web app backends because of this. Being able to have a drag-and-drop distribution is even better. |
![]() |
| Not a super-expert but I've used Vapor on some personal projects. Do you have a link to the mention for "protocol server"? I'm not familiar with the concept but might be able to help. |
![]() |
| I was maintaining a server-side app written in Swift from 2018 to 2020 and we ran into tons of issues at least back then. I haven't looked into all the improvements they did since, but you might want to check.
My coworker wrote down some of the major issues we were facing: https://forums.swift.org/t/issues-learned-4-years-with-serve... Personally, I've been soured enough that I don't ever want to write any server-side code in Swift again. It just seemed that Swift pretended to be open-source and cross-platform and then Apple would just unilaterally push some changes just because they wanted them for iOS (e.g. function builders for SwiftUI) without waiting for community feedback. It's fine to be a dictator for your PL, but not when you're claiming to have "open governance". All the while support for Linux was routinely being neglected. I would rather recommend Kotlin. It's similar enough to Swift and it comes with the advantage of having the whole JVM ecosystem which can probably do most things you'd ever want to do on a server. |
![]() |
| There are definitely languages with better cross platform support. But far better languages? I think Swift is a pretty good language and I like to know what you think is far better than it. |
![]() |
| Swift 6 is amazing - I say this as a big Rust person. It seems like Swift is now its own entity outside the Apple bubble and has a few very interesting features:
- An "embedded" mode that turns off reflection for kilobyte-sized binaries - An upcoming WASM target - An LSP for VSCode - Native C++ interop - Typed "throws" - Static linking on linux and the linux sdk - Porting a number of "core foundation" / foundation primitives to nix platforms - Distributed actors for concurrency that run on distant machines - Data-race free by default - non-copy RAII generic types Watch the video on Swift 6: https://developer.apple.com/videos/play/wwdc2024/10136/. IMO Swift 6 is a better Go and than Go, and a better Rust for app-dev type stuff, which seems to be what people want to use Rust for. Swift has shipped stuff that Rust has been sitting on its hands over for years: - Anonymous enums/structs in parameters/match statements - Named function arguments - A type of `Send` bound that allows Rcs to be sent between threads (not Arcs) - Swift preview hotreloading - autoclones (without GC) Swift also took a bunch of goodies from Rust *[1] - No garbage collector - Traits via "protocol" - ADT for Option/Result - macros - non-copy types enforcing RAII I really really wish Rust had been keeping up with Swift's ergonomics because it's looking like Swift is going to catch up to Rust's cross-platform story much faster. Swift really could end up as the "do it all" language for frontend/backend/app dev. [1] By "took" I mean if you like these things in Rust you'll see them in Swift |
![]() |
| Swift and Go are on polar ends of the language complexity spectrum. Someone who enjoys Go for what it is, i.e. a dead simple, straightforward language, would not see Swift as being "better". |
![]() |
| I have, and I am indeed very hopeful about the WWDC 2024-related Swift announcements. My comment was meant to illustrate my thinking circa a year or two ago. |
![]() |
| Isn’t “data-race free” in Dart achieved by just not really sharing mutable memory between isolates? Probably because the web version needs to map isolates to web workers, right? |
![]() |
| Great writeup, and I love that the authors looked at a lot of other languages. The solution section on how to prevent races is a bit light still - I‘m curious how they will solve this.
I think there will need to be exceptions to a strict race-free model eto not take away from dart‘s current capabilities, and without forcing people into something like a borrow checker. Swift has `@unchecked Sendable` which lets you tell the compiler "I promise I'll take care myself to keep everything in there race-free". What I‘ve been missing in Swift are tools that let me add safety _within_ such @unchecked Sendables. There's the Swift Atomics lib: https://www.swift.org/blog/swift-atomics/, but its quite limited in its capabilities. So for now, I find myself reaching for tools provided by the community, like pointfree's LockIsolated: https://github.com/pointfreeco/swift-concurrency-extras/blob.... |
![]() |
| I don’t think they were trying to claim that, just that it was a feature that was in Rust that they liked and wanted to keep using.
Just like Rust didn’t invent not using garbage collection. |
![]() |
| > Anonymous enums/structs in parameters
Can you share an example of this? It sounds really interesting but I couldn’t find any references. Do you mean the parameter “packs” features? |
![]() |
| It does, but it's also a really, really nice language. I'm excited to see Apple work to file those edges down. (and i say this as someone who is a Golang and Linux fan and owns zero iThings) |
Along with the move to a non-Apple GitHub organisation, it represents real progress in extending swift to other platforms.
It would be interesting to see if this is used for the AI OS that they are inviting researchers to validate for security purposes.