What Is Memory Safe? A lot of organizations, private and public, are starting to require that memory safe languages are used.
But what can be considered memory safe? Is memory safety a binary or a spectrum? Are languages without GC memory safe? People consider Rust memory safe, but there are a few cases where it is not. Is idiomatic Zig memory safe? Is idiomatic modern C++ memory safe? I'd like to read your thoughts. |
> People consider Rust memory safe, but there are a few cases where it is not
The chance that you will encounter memory safety issues in Rust is very, very low (comparing to other popular languages). We are talking about bugs in stdlib (very unlikely) and usage of unsafe in your code and dependencies. If you happen to use unsafe directly in your app, I'd say it is a spectrum and you can be in a danger zone. Otherwise, it is a small enough issue to focus on other problems. For 99.9% of people, "using Rust" is enough of a guarantee to be safe.
> Are languages without GC memory safe?
In theory, not having a GC in itself tells nothing about safety. Commonly used languages without GC are mostly C/C++, so in practical terms, they are unsafe.
> Is idiomatic Zig memory safe?
Zig itself is not memory safe. Even if idiomatic Zig was, how do you verify that some code is idiomatic? In practical terms, I don't think there is enough examples of Zig code to make determination, so I count it as no.
> Is idiomatic modern C++ memory safe?
"Idiomatic modern C++" very likely will have non-idiomatic or non-modern dependencies. There are many examples of safety issues in modern C++ codebases, so definitely not.
In my opinion, any definition of safety that relies on developer skills or usage of extra tooling means it is unsafe.
IMHO, there are two undisputed properties that definitely should belong to memory safety, and they are good enough to spot "unsafe languages".
- Every memory access should be valid. You cannot read or write a pointer that is uninitialized, that points to a freed object, or that is beyond the boundary of the array, etc.
- Every memory access should be properly synchronized. This implies strictly controlled mutability.
These properties are _enforced_ by the compiler. In safe Rust, you cannot create a dangling pointer and dereference it. You also cannot create a data race by accident. But in C, C++, Zig, you can. In this sense, languages with managed memory are usually automatically memory safe.
Note the "suggests".
That’s what readwrite.com says. I think what the NSA says (or said; that is dated April 2023) is here: https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI...
I couldn’t find the word “suggest” or anything similar to it in that paper. They describe what they mean by “memory safety” and give examples of memoryxsafe languages (twice, both times the same list)
and yet these are extremely useful.