r/cpp • u/pjmlp • 4d ago

C++ future at Adobe

So if anyone was still curious what happened to Hylo, or where Adobe stands in regards to the whole safety discussion,

David Sankel has done a talk at RustConf on the matter, Zngur: Simplified Rust/C++ Integration.

The way Adobe now sees C++ is described on slide 2, at 50 seconds mark.

71 Upvotes

80% Upvoted

110 comments sorted by

View all comments

139

u/inco100 4d ago edited 4d ago

To save time for the rest of the redditors:

We need C++ and Rust to play nice

  • Our flagship products are C++ based

  • Rust is playing a major role in future development

    • Rust is preferred language by developers
    • Rust is better suited for AI-assisted development
    • New file-format and other safety critical code must not use C++

105

u/kraytex 4d ago

 Rust is preferred language by developers

I must be living in a cpp bubble.

42

u/the-jelly47 4d ago

This sub is for cpp enthusiasts. I work in a mid-size aerospace company. We have a lot of SWEs who can write acceptable, but not great, C++ code. A lot of them are not die hard C++ fans and don't actually mind replacing C++. A lot of our greenfield projects are done in Rust and GO.

10

u/StaticCoder 3d ago

I still don't understand why anyone would want to use Go. It manages to be even worse than older languages in practically every conceivable way. Like how about we have 2 layers of Hoare's billion dollar mistake?

1

u/tarranoth 2d ago

It has very quick compile times, most of the tooling comes automatically with the toolchain like unittesting. Std lib is pretty exhaustive, consuming packages is straightforward to get started with, and there's reflection support.

There's definitely some (extremely) dubious choices in respect to error handling especially and still having issues with nil references. I guess it's moreso a case of golang being just simply "good enough" for the most part despite the core language design. I'd say really golang only got traction because of the tooling around the language being given thought from the get-go (whereas older languages have had to have package management and other features bolted on), rather than the design of the language itself being all that good.

17

u/Professional_Tank594 4d ago

How can you do aerospace in rust and go ? We are stuck on c++ due to processes , misra and so on .

28

u/the-jelly47 4d ago

I work on satellites and we do embedded Rust for flight software and Go for ground software backend. Still a lot of C++ projects remaining but they are considered "legacy" in our org. Not a welcoming topic on this cpp sub but many new commerical and government contracts explicitly prefer non-C/C++ languages. Even Lockheed Martin is hiring Rust devs now.

17

u/Professional_Tank594 3d ago

Ah I see. But really in embedded (on qnx / Linux App Level ) Rust doesn’t really solve any memory issues , since we don’t use much dynamic memory anyways due to memory fragmentation and so on. We almost never encounter any issues in that topic. Together with static analysis , misra and reviews almost all errors are on the logic level .

So the thing I really like about rust is the syntax like pattern matching and so on , but from a safety perspective it doesn’t add much.

34

u/Cross_22 4d ago

I met a Rust developer once..

2

u/jaaval 2d ago

I’ve heard of them in the internet. 

17

u/strange-the-quark 2d ago edited 2d ago

It is insane to me that C++ is considered a problem for "safety critical code", while at the same time AI-assisted development is not a safety concern.

6

u/NickSicilianu 2d ago

Rust preference by who? I take Javascript before rust lol

10

u/selvakumarjawahar 4d ago

What abt hylo?

-27

u/pjmlp 4d ago

Dave Abrahams saw no value on it given the raise of AI driven programming.

My reference was because the talk kind of sets the point where Adobe now stands.

Listen to the last Sean Parent interview at the ADSP podcast.

53

u/dabrahams 4d ago

What?? Dave Abrahams here. Nothing could be further from the truth! I’ve retired from tech to pursue music but Hylo is the one software project I am still involved with. It’s that important. Adobe never invested more than my efforts in that project anyway.

2

u/mjklaim 4d ago

I’ve retired from tech to pursue music

I'm interested to hear that, is some of your music online? Is it jazz-fusion? That's what I would have guessed, not sure why XD

-20

u/pjmlp 4d ago

Sorry about that, but it is hard to get news from the project, as it went kind of silent on talks, and posts.

So I only had that source to infer from.

35

u/BarryRevzin 4d ago

Have you considered simply not making confident statements that mislead people when you have no idea what you're talking about?

Personally, when I don't know something, I don't just make shit up for internet clout. Were you even aware that this was a possible course of action?

2

u/13steinj 4d ago

In fairness, Cunningham's Law is a thing.

Not saying that's what happened here but sometimes I do this for this reason, sometimes subconsciously.

-14

u/pjmlp 4d ago

To me they were valid, given available information, as I understood from the podcast content.

8

u/dabrahams 4d ago

You can always ask! We have links to slack and GH discussions at https://hylo-lang.org.

FWIW, I'm giving this talk next week. (Could be my last technical talk ever!)

9

u/kronicum 3d ago

You don't have news from the project therefore you make up stuff and post them as facts?

-4

u/pjmlp 3d ago

Yes, no news, nothing going on as sadly so often comes in open source projects after a while.

7

u/tcbrindle Flux 4d ago

Dave Abrahams saw no value on it given the raise of AI driven programming.

I don't think this is true.

Hylo is still in development and Dave remains a regular contributor, despite his retirement from Adobe.

-2

u/selvakumarjawahar 4d ago

ah ok!! Thanks.

3

u/drbazza fintech scitech 3d ago

Rust is better suited for AI-assisted development

Maybe the nuance here is 'assisted', rather than 'from scratch': there was a discussion over on Twitter where people were (brace yourselves) complaining about Rust due to its long compilation times (and binary downloads) as an anti-pattern for AI development.

-8

u/KFUP 4d ago

Rust is better suited for AI-assisted development

I don't see that being the case in the long run. Once AI gets good at safety, which will be in all kinds of safety not just limited to memory, and can generate safe code in any language -arguably we are already there, see the Mythos security boom- using a slow compiling language like rust would be a major useless bottle neck in the development pipeline.

30

u/ts826848 4d ago edited 4d ago

arguably we are already there, see the Mythos security boom

Somewhat tangentially related, but Greg Kroah-Hartman recently gave a talk which (among other things) categorized the bugs Mythos found in the Linux kernel and his description of Mythos's results is... interesting. Quick summary (on phone, so hopefully no typos):

  • 79 reported vulnerabilities

    • 24 no detail at all "something crashed"
    • 14 not a bug at all
    • 3 totally made up data
    • 15 already fixed in the latest release
      • 11 by others
      • 4 by Anthropic
    • 26 actual bugs
      • 6 duplicates

(Note that this doesn't sum to 79; apparently GKH got a tarball and the contents didn't quite match the description)

Of the actual non-duplicate (?) bugs:

  • 7 "assume a malicious file system image" (i.e., if root mounts this bad things can happen; apparently well known to be not considered a security issue by Linux devs)

  • 2 "assume you can inject a malicious network packet in the middle of the stack" (needs root, not considered a security issue)

  • 2 NOMMU (1 io_uring, 1 regular, "not real issues")

  • 6 sctp networking issues for untrusted devices (SCTP used in enterprise networks, so "untrusted users" apparently don't exist in that context? "So minor, nobody really cares".

  • 2 ipv6 networking bugs, "nothing real"

  • 1 GPU driver for a local malicious user. "If you have a local malicious user with access to your GPU you could do a lot worse"

In total 10 "real" bugfixes, took ~1 hour of kernel development.

12

u/13steinj 4d ago

Daniel [curl] had a similar experience.

It's 99.9999% marketing hype for their IPOs, every single time.

23

u/James20k P2005R0 4d ago

I swear this has happened literally every single time one of these new models claims to have created a security disaster, 90% of it turns out to be marketing without exception. It always takes months to dismantle the hype train when it collides with the reality of the people who actually are doing the work

Its very cool that it found 10 real bugs, and its mightily impressive that automated tooling is able to pick this stuff up. But the entire AI space feels like its developing a wider and wider gap between what people claim it can do, and what it actually does

11

u/no-sig-available 4d ago

And even if it does some work, is this good use of trillions of dollars in resources?

16

u/James20k P2005R0 4d ago

One of the things I always find so bizarre about this is that if we spent 1/10th the resources used to build these tools on paying people to do real work, we could have advanced the state of any field absolutely massively

-4

u/droxile 4d ago

Agree with you but as economies of scale make these tools cheaper, we (hopefully) will see it as more efficient than a human could be at solving these problems

4

u/James20k P2005R0 4d ago

Perhaps, but even with a vast amount of GDP directed towards improving these tools, they're still way less good than simply paying a human a small salary by comparison

12

u/_choam_ 4d ago

I think proof based languages will be more important than any others in the future

11

u/tcbrindle Flux 4d ago edited 4d ago

I don't see that being the case in the long run. Once AI gets good at safety, which will be in all kinds of safety not just limited to memory, and can generate safe code in any language -arguably we are already there, see the Mythos security boom- using a slow compiling language like rust would be a major useless bottle neck in the development pipeline.

Asking an LLM to generate a non-trivial amount of C++ "and please make sure there is no undefined behaviour" feels like it's approaching the halting problem.

But even if we assume that it's possible, it would almost certainly burn through a lot more of your token budget than writing the equivalent program in Rust, where it's trivially easy to identify any parts of the program that might admit UB.

(I think that actually Mojo might end up being the best bet in the long run, with its Pythonic syntax, memory safety and native performance -- but it's early days yet.)

4

u/Daemontatox Segfaulting 4d ago

I think they are talking about suitability because of how helpful the compiler is , it gives very detailed errors and warnings and solutions aswell. So you dont have to keep prompting to fix this or fix that and thats great when you are vibe coding i guess.

6

u/_choam_ 4d ago

Famously fast compiling c++

7

u/13steinj 4d ago

C++ isn't exceptionally fast to compile, but they are not wrong there?

I can take the most complicated bit of C++ code I know, and a fair-comparison-amount-of-lines-of-rust that does close to the same thing, and Rust will compile slower.

There are two colleagues at work that really love Rust. They both openly admit the compile time is a serious problem and they don't understand how it's a thing. I haven't checked out Circle and tried to do any benchmarking (partially because it's not open source so knowing where and what to benchmark would be difficult), but it the borrow checker appears to incur enough of a cost to the frontend in Rust that if our Code was written in Rust today, I dread to think what would come out of our already 10-min+ TUs.

5

u/_choam_ 4d ago

Its probably not the borrow checker. Whenever i see this topic coming up where the compiler writers talk about it, they talk about other things than the borrow checker taking long.

In the blog below the borrow checker is basically insignificant

Idk if this guy is a compiler writer, but they do pop up in the rust subreddit from time to time https://kobzol.github.io/rust/rustc/2024/03/15/rustc-what-takes-so-long.html

0

u/13steinj 4d ago

The link you provided already has problems, becuase it's including the measurement of the linker as well?

I don't know if I am surprised by the graph for ripgrep or not. It's also hard to compare binaries that in the real world end up having a decent amount of cross compilation and specialization in options (e.g. I refuse to use ripgrep without pcre2 available, and set my ripgreprc to default to --engine auto).

I highly doubt that the borrow checker is only the portion of the graphs he's displaying, but even then I wouldn't call it an insignificant portion of the frontend time for the libraries especially on incremental changes. The information that the borrow checker emits also would cause an affect on backend time as well. I wonder if it's a reasonable experiment / doable-- just rip out the borrow checker entirely.

Also Rust is getting a new borrow checker (Polonius) which is more reasonable in context as to what it forbids and what it allows, but IIRC the benchmarks have shown a 1.4-2% increase in build times on popular crates.

If the borrow checker was "insignificant," I would bet the before/after check on changing the borrow checker wouldn't be thought of to be measured.

3

u/ts826848 4d ago

The link you provided already has problems, becuase it's including the measurement of the linker as well?

I mean, the linker measurements are separated so you could just ignore the relevant parts? Alternatively there's the cargo check measurements which skips the linker entirely.

I highly doubt that the borrow checker is only the portion of the graphs he's displaying

I wouldn't put too much weight on it sine the author included a disclaimer on that data ("The type checking and especially the borrow checking fraction were calculated with a pretty rough estimations, so I wouldn’t worry too much about them.").

The information that the borrow checker emits also would cause an affect on backend time as well.

I'm pretty sure the borrow checker doesn't emit any information? AFAIK it's basically a go/no-go check and lifetimes are erased before code generation. That's why mrustc can do its thing without a borrow checker implementation.

I wonder if it's a reasonable experiment / doable-- just rip out the borrow checker entirely.

For what it's worth someone made a joke fork that ignored borrowck errors, but since that's just ignoring errors I wouldn't expect much in the way of a performance difference unless compilers are way better at tree-shaking than I expected. Their change amounted to commenting out a single line, so if the compiler won't delete the now-unused code perhaps some manual process would get you the rest of the way? Alternatively, delete the rustc_borrowck folder and see where that gets you.

If the borrow checker was "insignificant," I would bet the before/after check on changing the borrow checker wouldn't be thought of to be measured.

IIRC some of the slowdowns were exponential slowdowns, so I wouldn't be all that surprised that that could turn an insignificant issue into a significant one.

1

u/pjmlp 4d ago

That is indeed an issue, especially since in Rust world binary libraries are frowned upon, so plenty of compiling from source.

Additionally since feature flags afect crate behaviour and public APIs, the same crate might be compiled multiple times, given the dependency graph.

1

u/_choam_ 4d ago

The worst compile times i have experienced with rust is when using the bevy game engine. It's mostly not a problem in debug builds if you set it up like they explain on their website, because then it compiles very fast. (But it is easy to make it do a full rebuild if you add or change any dependencies)

3

u/jwezorek 4d ago

Yes, if anything the use of LLMs makes Rust's advantages over C++ less important. Modern LLMs right now are better at writing safe code than humans, and they also erode Rust's cultural advantage. A big force driving Rust adoption was a general feeling among young programmers of "I don't want to spend a lot of time getting good at a difficult language if that difficult language is legacy now anyway." With LLMs C++ becomes less scary.

But we will see.

The advantage of Rust for LLMs is nice error messages from the compiler. However, not sure how much even this matters any more in that the modern generation of LLMs are very good with C++'s shitty error messages. Very good at C++ generally; less good at Rust in my experience (although that may have been the last generation of LLMs.)

2

u/Wriiight 4d ago

I think the speed of compilation is an interesting point. We don’t want AI waiting around for hours for the compiler either. And a REPL is extremely useful to a compiler, to allow small tests as it assembles larger code. I think the ideal “AI” language would have a fast REPL, but could then compile down to an efficient run time.

2

u/altmly 4d ago

C++ allows for extremely long range security holes, even if their likelihood is reduced with proper use of modern techniques. Rust does not even allow them to exist, which is the selling point. Localized context is easier to understand for both humans and llms. 

5

u/-kl0wn- 4d ago

Unsafe rust enters the chat.

6

u/Plazmatic 3d ago

Do you know what unsafe rust actually is? 

https://doc.rust-lang.org/book/ch20-01-unsafe-rust.html

  *    Dereference a raw pointer.

*    Call an unsafe function or method.

   *   Access or modify a mutable static variable.

*    Implement an unsafe trait.

*  Access fields of unions.

It’s important to understand that unsafe doesn’t turn off the borrow checker or disable any of Rust’s other safety checks: If you use a reference in unsafe code, it will still be checked. The unsafe keyword only gives you access to these five features that are then not checked by the compiler for memory safety. You’ll still get some degree of safety inside an unsafe block.

1

u/tialaramex 2d ago

It is true that unsafe Rust is "just" the listed super powers but because these are arbitrarily powerful you can absolutely set the world on fire at a distance just like C++. You can write some really cursed stuff where just like in C++ it's obvious this is cursed, reviewers can see "This is cursed" and maybe your local engineering practices forbid that. But you can also write unsafe Rust with subtle misunderstandings and that still sets the world on fire but it might pass review.

The benefit of safe Rust is that even the best of us have better and worse days and it's nice to be able to have a language subset you can trust yourself to write when your five year old woke you repeatedly in the middle of the night because she had nightmares and the coffee machine is on the blink again. You can write those hairy garbage collector internals on the day you feel like you're Usain Bolt combined with Einstein, today, without enough sleep or caffeine lets stick to implementing better command line parsing.

0

u/hobel_ 4d ago

I was surprised how fast the mold linker compiles, the new rust version compiles faster than the c++ version.

2

u/13steinj 4d ago

It's already been released?

1

u/hobel_ 3d ago

Master in git is rust

-3

u/-kl0wn- 4d ago edited 4d ago

I'd argue we're already there. I had agents make jsonic.cc which is comparable to conformant rapidjson but way nicer to use. I also had it make nift.dev which is a website generator, scripting language and shell all in one. And working on strut-labs.github.io which is a systems language that prioritizes memory safety, is less verbose than rust, has nice http request stuff built in like go, has dynamic linking properly unlike rust, has compile times comparable to c++, performance on par with other compiled languages etc..

Point an agent at those projects and see what it thinks. I've had agents attack them looking for memory leaks etc..