I've seen this one come up a few times in PL threads too... despite what some believe, Go is not a memory safe language!

Erin 💽✨

@lina I definitely think we need to distinguish "strong memory safety" (impossible to break memory safety; Rust) from "weak memory safety" (impossible to break memory safety without data races; Go and I think Swift?) because both of these are very distinct from no memory safety at all (C, I think Zig?)

Asahi Lina (朝日リナ) // nullptr::live

@erincandescent Maybe we should call them "single-threaded memory safety" and "concurrent memory safety"?

It's a pretty big distinction though, because most complex programs these days are multithreaded! Having single-threaded memory safety is definitely better than not, but can't really provide any hard guarantees once you throw threads in the mix.

Erin 💽✨

@lina you can't provide guarantees but my experience is that threading related safety bugs are much more rare, and I think they've also proven much harder to exploit in practice

eta

@lina the main thing that spooks me out about Go's attitude to concurrency is the remarkable lack of documentation about what is safe to do from multiple threads versus not; I'm used to Rust having Send and Sync, but it seems in Go you just have to guess?

Erin 💽✨

@eta @lina Everything should be considered unsafe unless documented otherwise TBH

Morten Linderud

@lina
But does this work the reverse way? There are multiple known soundness issues with rustc that can lead to memory issues or segfaults.

Where do you draw the line when saying something is and isn't memory safe?

Josh Simmons

@erincandescent @lina it's going to depend a lot on your domain I think, in (large) games at least a *lot* of issues come from the combination of threading and memory unsafety.

Josh Simmons

@Foxboron @lina generally I wouldn't expect anyone to consider compiler bugs as contributing to the notion of safety.

Morten Linderud

@dotstdy @lina

Ahh, right! That is a practical distinction I didn't realize

Erin 💽✨

@dotstdy @lina if you're working in a domain with pervasive shared mutable state, of course. But most domains are not like that