Google’s adoption of Rust has finally paid off…

[@letsgetrusty]

Get your *FREE Rust training* : letsgetrusty.com/bootcamp

[@align-dev]

Time to add 5 years of experience in Rust to my Resumé.

[@nakatash1977]

If hearing about people talking about Rust counts, I have over 7 years.

[@jessequartey]

😅😅

[@sylvereleipertz955]

You still won't find any job in it

[@rumplstiltztinkerstein]

The official Rust Book that can be find in the official website has basically everything we need. 3 weeks reading through it and doing the examples should be enough to give you a good experience with the language. The only issue that I should warn about is that Rust is not a language that lets us easily prepare "quick fixes" in a short time. Following proper design patterns is essential for not wasting hours and hours trying to understand what the code is doing.

[@align-dev]

@@rumplstiltztinkerstein So a course in computer or network (among others) architecture as well as one in system/software design will be needed. Small issue.

[@frittex]

glad to see Rust adoption is growing. not only the software gets better, which is good for everyone, but also the job offers increase, which is good for us, rust developers

[@pookiepats]

I don’t buy your facade

[@JorgetePanete]

Job offers must be the best thing to point out right when we're seeing full automation starting to happen.

[@frittex]

@@JorgetePanete idk if this is sarcastic or not, but as a human living in a society, I care if I can feed myself and have a place to live more than if some big company is using different words to make things

[@Steel0079]

It was not sarcastic I think ​@@frittex

[@diadetediotedio6918]

Uh, this is the kind of interesting things to see. Confirmation of the language benefits in a real worldwide used project like android.

[@ZenCarry]

Also shows that Rust works well as a systems language in a memory constrained environment (mobile phones).

[@torchila]

maybe Auaurora would have less memory issues if her horseshoe was written in Rust

[@_garicas]

Also in the Linux kernel, but a bit restrained

[@basedfacistman]

hi bern

[@diadetediotedio6918]

​@@basedfacistman hi oishi

[@stillness0072]

Rust cheatsheet finally paid off

[@letsgetrusty]

I gave Google the enterprise edition

[@morkhoudia9]

​@@letsgetrusty would you share it

[@RiwenX]

Started learning Rust 3 years ago, nowadays I'm finally comfortable with it, in fact it's my primary choice for most applications. I hope to land a job where I can use Rust for a living, it would be a dream

[@_garicas]

I gotta be the luckiest in that, I got a job as Rust developer and cryptography related, but I didn't know Rust well, I just knew the difference between String and an &'str

[@InstaKane]

Yikes, 3 years to be comfortable with Rust. Is it your first language? As in you probably learned the language sooner than that but learned broader IT topics via Rust?

[@peterdecroos1654]

@@InstaKane c++ is worse. bjarn stroustrup himself says he doesn't know all the details of c++ AND HE CREATED IT

[@RiwenX]

@@InstaKane Well I wasn't using Rust all the time during that 3 years lol, but rather did side projects scattered over the years. It's my first low-level language, so yeah, I pretty much learned how computers work by learning Rust.

[@InstaKane]

@@RiwenX makes sense

[@andrewk866]

Dropping from 76% to 24% is actually a ~66% decrease. Say you has 3 quarters of a pie (75%) and now you have 1 quarter (25%), you now have two thirds less pie. If the goal is to get memory safety vulnerabilities to 0, it's currently improved by roughly 66% when it dropped by over two thirds from 76% to 24%.

[@T1Oracle]

Unfortunately, even old code can have memory safety issues. Just because an exploit hasn't been noticeably exploited, doesn't mean that it can't be exploited, or even that exploits aren't currently happening unnoticed. The only way to guarantee there are no memory vulnerabilities, is to have formal proofs of your code or use methods that are already proven to be memory safe. Rust makes the latter much easier to do.

[@Dayanto]

0:44 This might sound small until you realize that 76% -> 24% is actually a *_10x_* reduction. From 3.2x all other bugs to just 0.32x.

[@andersjenbo8414]

Sure,if you assume the total Is constant

[@ronald3836]

It fully depends on how the total number of vulnerabilities behaves over time.

[@Kronicaler]

Can you give the link to the google article?

[@letsgetrusty]

security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html

[@Kronicaler]

@@letsgetrusty thank you!

[@CamaradaArdi]

Actually it's not a 50% reduction, it's a 66% reduction, which is even better! You can think of it as from 3/4 to 1/4

[@jedi10101]

what happened to their golang?

[@turanamo]

😂

[@khaid.5167]

downward and abandon soon

[@TheEvertw]

Great News! We all knew that Rust will decrease the number of problems in code, but it is great to see data that so clearly demonstrates this. However, your graph which includes the numbers for 2024 is a bit misleading, as 2024 isn't done yet -- so that bar will rise before we are done with 2024.

[@jeffreyvanderstoep4937]

The cited blogpost says that the number for 2024 is extrapolated - was 27 as of September when the blogpost was published, but represented as 36 (since that's what 3 more months of vulns would look like at that rate).

[@tth-coulid]

why don't google use GO?

[@h0stI13]

Rust is mostly used for system software, for now at least. Go is garbage collected which doesn't make it fit for system software development.

[@atultripathi9166]

The good thing with these "safe" languages is that more and more of the bugs are getting caught during compile time and so there will be less and less of "surprises" during runtime. But this also means that if it took 24 hrs to C++ code to build it might take roughly 32 hrs to compile rust code as rust compiler does a lot of checks before it blurts out an executable.

[@Caellyan]

Compile times depend a lot. Both languages have quite a few knobs to change how long the compilation takes. Rustc does a lot more though, so even if both were perfectly optimized (which they're not), Rust would probably take a bit longer to compile. In practice however, there's a lot of projects in C++ which heavily rely on templates and take hours to compile, rust has a few crates like this but it's far less reliant on metaprogramming than C++ is.

[@andrew.derevo]

it’s my little bit of topic here, but very interesting your opinion about the mojo and all the stuff going around. mojo have some similarity with rust will be great to hear your opinion about.

[@negativetime]

It's funny how commonsense applies to the rust code. Every time I try some common sense on my rust bot it works. I guess the ownership of memory does make a big difference. I think my bot loves the refinement.

[@Zombehmoviez]

I was just trying to write some android apps in rust the other day following the guide Google made. I'm getting an error that I don't have the dependencies wear-sdk, does anyone know what I did wrong or how to compile my cuttlefish android emulator?

[@belkamax05]

In other words it means go share will decrease too. Their own GoLang does partially same level of responsibility and adoption of rust means less use of Go for writing tools which could be done on Rust

[@maxrinehart4177]

They use Go for their enterprise infrastructure, servers, and cloud services. Rust, on the other hand, is used for low-level system programming. Rust wouldn't encroach on Go's share, especially in CLI tooling, because their domains of use do not intersect.

[@belkamax05]

@@maxrinehart4177 I didn't mean they do intersect all the time, but they do to some extend. At least there's a choice to make what to study first, as they both can be used on creation of desktop software. System level is rust, clould level infrastructure is go, but many things are in between and choosing one over another is gonna to be on a table of questions.

[@belkamax05]

@@maxrinehart4177 agree to disagree. "Rust wouldn't ... especially in CLI". Wrong, this is exactly what it does. Apart of one areas where choosing one language over another have practical reasons, Go vs Rust does intersect at many levels and CLI tooling is one of that level, where choice isn't simple to make.

[@rct999]

Does writing in Rust also statistically lower other types of vulnerabilities?

[@michaelcummings7246]

Generally with rust you only end up having logic errors or bugs which are much easier to find with proper automated testing or worse case by beta testers so you can add the tests and fix them😉 Once rust code compiles it will run and your tests can run then it's just making sure all the required features work and no extra ones have been added😜😂

[@ccgarciab]

It's a good question. Grammatical features like enums, pattern matching, and encouraged design patterns like marker traits and using lifetimes for state management can't guarantee complete safety, but should theoretically help with mitigating logical bugs. It would be cool to see if that's true to any extent.

[@Nina-cd2eh]

@@ccgarciab Anecdotally, because the Rust typesystem is more expressive of requirements, it makes it a lot easier to write code the way you intend too. You learn to rely less on function apis or long blocks of procedural code, and more on the typesystem with all its compile time benefits used in a declarative style that meshes well with it. This tends to expose faults in your logic and assumptions a lot easier.

[@SaiprasadToshatwad-u6j]

I just wanna to ask that if we have to program bare metal in unsafe way then why not do it in c

[@megagurka-d8x]

This video quite clearly show why you don't want to do that

[@foreignconta]

There was also news of C++ getting a borrow checker and the syntax kinda looks like rust.

[@empathy_monster]

That's not an official C++ proposal. It's basically a one-man show with the community pushing for it. It's called Circle.

[@diadetediotedio6918]

not even close

[@NotherPleb]

unfortunately that's just Sean Baxter initiative, basically no one in the committee is fond of the proposal

[@firen777]

Can I ask why you say it's counter intuitive for numbers of memory related vulnerability to decrease when Google is using memory safe language?

[@techpriest4787]

I think because it was new code added and not even old code rewritten while old code even increased too.

[@jackthatmonkey8994]

You have a small% increase in legacy code, with memory safe code added to it, not refactored. The added memsafe code decreases vulnerabilities by a much higher% than expected, it makes legacy code safer just by being used

[@diadetediotedio6918]

@@jackthatmonkey8994 Not by "just being used", but because it is maintained.

[@ronald3836]

Memory safety increases "exponentially" over time? That is a ridiculous statement by Google. Logarithmically is more realistic.

[@andrewk866]

"...has deliberately [written]" not 'wrote'

[@NuflynMagister]

Дякую, Богдане!) So...Carbon lang is now dead - another grave of Google Cemetary?

[@LaughingOrange]

Google is big enough one team can love Rust, while another swears Carbon is the future, and management let's both do their thing.

[@Marhaenism1930]

ady dead before bloom.. long ago ppl said flutter(dart) is Future, now have u ever heard it (again) on these days?

[@SunHail8]

what about speed & battery draining ?

[@nicholas_obert]

There shouldn't be any noticeable effects since all is compiled down to, often the same, optimized machine code. There may be performance improvements thanks to memory safety, though, which would prevent most memory leaks.

[@SunHail8]

@@nicholas_obert Rust is slow thing, the're no many ways to enhance performance. for instance, delayed initialization is massive help for long/deep loops. Void pointers of C, no one can beat in matter of speed & energy saving. CStrings are utterly ridiculous...

[@nicholas_obert]

@@SunHail8 I don't seem to understand what you're talking about. Void pointers are no different than any other raw pointer, plus Rust has them. Or you could use the Option (NonNull is a pointer that cannot be null, so the None option discriminator is the value 0, just like raw null pointers) for a safer pointer that is still 8 bytes wide. Late initialization is also a feature in Rust, so I don't see your point. C strings are accessed through a raw pointer and require you to calculate their length for certain operations, whereas Rust &str are a wide pointer that also stores their length, eliminating the need for the null termination character. Rust strings being utf-8 encoded by default renders them more versatile. However, nothing stops you from using ASCII strings to get O(1) indexing. As regards which string type is best, it really depends on your needs.

[@Nina-cd2eh]

@@SunHail8 That's just not true. It all ends up the same machine code. Your cpu doesn't care if your pointer has a type declared in your text files... Rust is absolutely not slower in any way. If anything it tends to be faster just because of issues solved at compile time.

[@SunHail8]

@@nicholas_obert just try allocate huge chunks of memory: in C, those chunks can be easily reused; in Rust, they must be reallocated + no way to use non-initialized vars. So, yes - Rust is slow.

[@Sean_neaS]

I wish we could write apps in rust. The whole idea that they choose the language that every app is written in is crazy too me.

[@gljames24]

You can write android apks in Rust.

[@edihasrin7290]

@@gljames24 really?

[@tenebrae711]

@@gljames24 I don't believe you... I have 7 years android dev experience, and I know the intrinsics of the android app structure

[@Sean_neaS]

@@gljames24 You can do anything with enough wrapping layers but is it efficient, supported by apple and google and will t be around in five years.

[@fluoriteByte]

​@@edihasrin7290 most likely, android apps can have native binaries in them

[@shingyanyuen3420]

I am using Rust's Actix web to build APIs 😁.

[@s1v7]

i use arch, btw

[@FedoraSilverblue]

I use cachy os btw.And i use cosmic desktop environment which is written on rust

[@kevinchadwick8993]

Glad to see this but has Google and Android evaluated Ada like Nvidia did or just mindlessly jumped on the Rust hype train. Ada comes with more safety, less developer friction and results in more maintainable code bases.

[@LostRunner0213]

thanks for these examples

[@kamertonaudiophileplayer847]

I do most Rust development for web applications. It's cool.

[@Chastor97]

nice haircut 👍

[@justinhale5693]

That's great news for memory safety, but what do we know about the relative speed of development?

[@michaelcummings7246]

@@justinhale5693 50-75% less bugs to fix can only increase dev speed. Usually takes a month or two to get back to speed when learning a new language then productive goes back up and continues to increase for another 6 months

[@justinhale5693]

@@michaelcummings7246 My hunch is that you're right. Any objective data would be great though. We all assumed a language designed for memory safety would yield more memory safety and it did, but I couldn't have predicted the specifics and sometimes our intuitions fail us.

[@sonumyname]

Then why google created Golang?

[@Marhaenism1930]

google being google y'know

[@sonumyname]

@@Marhaenism1930 😃

[@eyz-4]

go is not suitable for everything. they still use it, but just not for everything.

[@nickernara]

get rusty. its tough but worthful life time learning and get offers with good pay

[@kralle333]

Don't see many rust positions out there.

[@nickernara]

@@kralle333 please check over in blockchain space. rust is most paid skill set in blockchain.

[@AdamFiregate]

Many Rust positions offer average or below average pay if you find any. Also many Rust startups pay badly.

[@khawarizmyana]

I use Golang BTW

[@Antipolitisch]

Mhm, need to learn rust soon.

[@Kiyuja]

Positive news from the big players about Rust is insanely valuable for the ecosystem. Maybe now there will be even more eyes on it and what it tries to solve. Maybe that'll lead to more adoption, awareness and tools being developed. Like am I the only one who wants another rival to RustRover??

[@lightprogrammer]

the villains went nuclear :(

[@charredbirchguy2349]

I'm missing something. "... was able to cut memory vulnerabilities in Android by 52%." implies there are still memory vulnerabilities despite using Rust. What memory vulnerabilities are still possible with Rust? Is this something with Unsafe Mode, or is there something else?

[@italktocomputers1901]

not everything is in rust yet

[@antifa_communist]

Not from the Rust code, from all languages

[@davithov]

if you want memory security in c++ you can utilize, e.g., smart pointers instead of raw pointers. No need to blame language if you can't write proper code.

[@bokangsepinare7428]

It even has a way of owning pointers and borrowing them

[@thomashabetsse]

Not so much "has finally paid off" as "shares data about how it was worth it (all along)".

[@shawazonfire]

why your eyes always look like you didn't get enough sleep bro

[@shawazonfire]

because you're always coding rust?

[@tomekg6629]

All you said about rust was true, but mentioning kotlin in this context does not make sense. Google's own popular apps became less stable since introducing kotlin.

[@CielMC]

3:40 All *new* native code

[@swifty8bit]

LETSGOOOO RUST SUPREMACY

[@quantumsoul3495]

kotlin vs dart please

[@peacefuldeityspath]

dart is low level since it compiles to exe's, while kotlin runs on the jvm. use dart if you wanna do native stuff along with your kotlin app. use kotlin for android development or if you want you can combine both of the 2 using Flutter in my opinion i use kotlin. but there is nothing wrong with dart

[@Victoruvarov23]

Kotlin is the standard programming language for Android applications and Dart is primarily only used for Flutter applications.

[@quantumsoul3495]

@@Victoruvarov23 But their language features

[@niamotullah99]

Still the question remains, when it will pay me besides changing my behavior :)

[@jagagemo8141]

Android? Oh boy, those Lijux kernel C guys have an all new reason to get a belly ache.

[@fuzzylogicq]

well if they know the percentage left (that 24%) why not also remove those vulnerabilities and go to 0% instead of shipping code that's currently 24% vulnerable. (I'm just being an idiot 😂)

[@qwertyqwerty-jp8pr]

bruh Anyway that 24% means discovered during the year, not all vulns. Of course you patch it once you know the vuln

[@j-p-d-e-v]

This is the sixth time I see that article lol

[@shis10]

Job description : need 15 years of experience in rust. 😂

[@Jan-gl7mn]

I am starting to suspect that you really like Rust.

[@Marhaenism1930]

he is, thts why his channel name called 'Rusty'

[@benotisanchez5583]

Lol artificial unintelligent chatbot gemini was made with rust. Enough said.

[@lpls]

One of Rust's biggest advantages is also one of its big hinderers: it plays nice with every other language. It's pretty easy to use Rust with something else... companies don't have to make a commitment to Rust.

[@Sarfarazzamani]

How can you read that messy syntax?

[@anandhu_remanan]

@@Sarfarazzamaniexactly

[@bandr-dev]

did he say sewer c++ xd?

[@SiliconLight]

Memory safe language adoption is certainly a good thing, but there seems to be a false narrative here. Rust is memory safe, so regardless of how much the lines of code (LOC) in Rust grows, it should have NO impact on memory safety vulnerability counts UNLESS it's the old C/C++ being rewritten in Rust. So here's the real story: C/C++ LOC continued to grow 60% over 5 years but memory vulnerabilities reduced by a factor of 3. The narrative that's being pushed is that Rust somehow was the key contributor, but the real contributor was more awareness of memory safety and the usage of tools for C/C++ to detect memory issues. So the adoption of Rust will continue to pay off, but the numbers presented here are misleading. An example of numbers that aren't misleading would be if they said that they rewrote 80% of the C/C++ in Rust and their memory vulnerabilities reduced by 80%. That's a clear accurate truthful picture. The numbers being presented are not.

[@jeffreyvanderstoep4937]

The blogpost he's citing goes over exactly why it works that way. It's a neat result and is easily reproduced in both simulation and real life as was demonstrated by Google.

[@ccgarciab]

Eh, that's not quite the narrative being "pushed". In the original post, the decrease is attributed to the fact that memory vulns have a sort of "half life". Older, battle tested code will have the vulnerabilities detected or reported (often by users), and will become safer as time goes by. But in the past, it was expected that the total share of vulnerabilities that are due to mem safety wouldn't decrease because new code would introduce many vulnerabilities. Now with Rust, the vulnerabilities are being fixed at the usual rate, but new ones are being introduced much more slowly. They modeled this hypothesis based on previous research, and it fit the observed behaviour of the codebase and bug backlog. It also correlated strongly with the introduction of "safe coding", as they have taken to call it.

[@RustIsWinning]

This has to be bait lmao

[@SiliconLight]

@@RustIsWinning It's not meant to be. I have been really focused on the integrity of scientific reporting lately especially with how much P-hacking is going on in broad daylight these days. I feel that the article is trying to paint a picture that's not accurate. It's like someone saying "look at how great a job I did", but their data is manipulated or the conclusion they're presenting is not reflected in the data.

[@RustIsWinning]

@@SiliconLight Ah I did not know that the integrity of science would say things like: "here's the real story", "but the real contributor" and "truthful picture". This is full copium mode. Keep it up my 🤡! LOL

[@mback3713]

Wait... Kotlin or rust furries? Which?

[@samjiman]

Now if only they could improve their search.

[@s1v7]

nice

[@JenniferOsia]

Hi Bogdan, I sent you an email. Thanks!

[@gdotone1]

c++ was a mess to start with. it has only gotten worst. c has find as a hacks language but it was really bad too. being cryptic should never be valued in a programing language.

[@seefinish_]

Cool

[@eXca1iburN]

So they've given up on carbon too? 😂

[@Sarfarazzamani]

The syntax is super ugly and messy. No matter how much you rustaceans chant it's safety. It's unreadable

[@RustIsWinning]

Says the guy in that PFP hahaha 😂

[@Sarfarazzamani]

@@RustIsWinning What's wrong with that? Jungle and river is the background. Better than having a crab and hide behind it like a coward

[@RustIsWinning]

@@Sarfarazzamani What's wrong? Maybe ask yourself how smart it is to write the same comment below every new video on this channel like an NPC 🤖

[@Sarfarazzamani]

@@RustIsWinning You behave like a 12 years old kid! In every page looking for programmers who don't use rust and sabotage comment section. Rust syntax is unreadable and rust community has toxic people like you

[@RustIsWinning]

@@Sarfarazzamani Filtered by KZbin. Nice try hahaha but YourMama is toxic.

[@tonym5857]

👌👌👌👏👏👏

[@TechLord79]

Meanwhile, bickering and bitching on the Linux kernel dev lists ...🤷‍♂

[@klirmio21]

there are no jobs in rust for junior devs

[@kafelinux]

I want build nuke missile controller using rust...

[@azharalibhutto1209]

❤❤❤❤❤❤❤❤❤❤❤

[@akza0729]

C is better. We the C developers will prevent Rust adoption to Linux till Linux dies.

[@ccgarciab]

So dogmatic and unhelpful. Try doing good work, instead of impeding that of others

[@Mangdens-d4w]

First

[@abiiranathan]

C is easier to write though 😂

[@darukutsu]

problem of C inconsistent syntax. Zig aims to fix this + it's a build system so no need to learn make,cmake etc

[@31redorange08]

It's easier to write compilable C code. But that's not a good thing.

[@abiiranathan]

I said this in jest of course but you brought out the truth in it. Learning Rust not for the faint hearted. But I had to port my buggy thread pool implementation from C to rust and used it as a shared lib in C. It worked like a charm!

[@robertsimplerino]

here before @RustIsWinning 😎

[@NotherPleb]

that guy is everywhere that mentions Rust

[@RustIsWinning]

Since when do people know my name lol

[@NotherPleb]

@@RustIsWinning hey there

[@conquerorofindia]

​@@RustIsWinninghere's my Rust warrior.

[@adrian_sp6def]

what the hack!? I just figure out that .cargo and .rustup weights almost 4G in my home directory! Along with ~300M of sources for 2 really small projects, rust weights a lot. Edit: I forgot about my 3rd rust project (for raspberry_pi pico they weight 1.1G...)