upvote
Probably Rust, that's always Rust with this kind of comments...
reply
Or basic software engineering and understanding of what memory safe means.
reply
Memory safety != Data race free
reply
Yes, but Rust gets you both.
reply
> That does not make sense to me.

You said that because you assumed Go is memory-safe in all conditions.

> Go is memory-safe

Yes, but only if there's no data race.

Go is not like Java. Java doesn't guarantee no data race, but when it happens, it's still memory-safe.

reply
Neither Java or Go guarantees data-race freedom. A data race does not by itself make ordinary Java or Go code memory-unsafe in the C/C++ sense.

I fail to see how a racy Java program is more memory safe than a racy Go program?

reply
Java arrays are thin pointers to Array objects, which contain the length and data in the same place (on the far side of the pointer). Since thin pointers cannot tear and Array objects cannot be resized, Arrays themselves are always memory-safe in safe code.

Go slices are fat pointers to undecorated memory. The slice itself is a 3-tuple of pointer, length, and capacity. If you append to a slice that's already at capacity, the Go runtime will allocate new memory for you and return a new 3-tuple. If you assign that result to a variable that's also being accessed by another goroutine, the latter can observe the slice in an inconsistent state. It can, for example, see the old pointer but with the new length, allowing out-of-bounds access. None of this requires unsafe code.

The same issue applies to string and interface variables, which are also fat pointers.

reply
Indeed.

Shared Go slices are a bad mix in concurrent code. This is a given. But its also not a fair comparison, you should instead compare java arrays to go arrays, not slices.

This goes for slices, strings and maps. Those a usually wrapped in a mutex, or used with sync primitives like sync.Map.

reply
The exact equivalences between the two languages are not the point, and anyway, Go arrays are fixed-size and have no Java equivalent.

The point is that Java does not have this problem in the language or the standard library. Of course, you should not write racy Go code; the language provides ample ways to avoid the race, such as channels; and the race detector will generally find such racy code, provided you turn it on. However, the issue is that this race leads to memory-safety violations; it can occur especially in code written by novice Go programmers, and it's well acknowledged by the language authors [1].

[1]: https://research.swtch.com/gorace

reply
> Those a usually wrapped in a mutex, or used with sync primitives like sync.Map.

The same can be said of C or C++ constructs (and many "anti-Rust" people have historically said that) -- the point is that their use is not enforced by the language and so bugs can lead to panics.

I write a fair amount of Go and Rust so I really don't think either language's flaws are fatal, but it comes off as weirdly defensive to redefine memory and data safety to be "well if you use it properly it's safe". It's totally fine to say this is a problem the Go language did not find important enough to require compile time enforcement and so solving it is done by convention and testing with the race detector (which a similar answer C and C++ give to this problem).

reply
Java data race doesn't segfault
reply
From what I understand a data race on a simple built in feature like an interface pointer can result in a bad address / type pair, which can cause memory safety issues on any future access. I don't think you can get the JVM itself confused about what type a pointer points to.
reply
There is no memory safety without freedom from data races. One is a prerequisite of the other. This is why languages like C# throw exceptions on unsynchronized concurrent access to some container types, and treat all property accesses as atomic.
reply
From the former head of the Go security team [1]:

> I have never seen real Go code (i.e. not code written purposefully to be exploitable) that was exploitable due to a data race.

And from tptacek in that same discussion [2]:

> The fact is that Go doesn't admit memory corruption vulnerabilities, and the way you know that is the fact that there are practically zero exploits for memory corruption vulnerabilities targeting pure Go programs, despite the popularity of the language.

[1] https://news.ycombinator.com/item?id=44672003

[2] https://news.ycombinator.com/item?id=44672371

reply
Memory safety isn’t really about vulnerabilities. This thread is about Go, so I won’t go further into it here.
reply
Are you saying any language that does not promise data-race freedom is memory unsafe? That would rule out almost every programming language.
reply
I am, but you’d be surprised. All of the single-threaded languages are fine, for example. Very few languages are actually low-level enough to allow data races. C# and Java go to great lengths to avoid it.

Race conditions in general are another matter, and aren’t generally considered a requirement (though you can certainly create nasty bugs).

reply
I have not written a line of Java in 15 years. But im pretty sure Java has threads? Once you have threads, you pretty much have data races.

        Thread a = new Thread(() -> x++);
        Thread b = new Thread(() -> x++);

        a.start();
        b.start();
reply
The claim is not there is no data races in Java programs. The claim is that Java programs are memory safe, because the underlying virtual machine memory model is free of data races.

Go does not have that.

(Of course also Java may suffer from memory safety issues on system boundaries to unsafe code and due to JVM bugs.)

reply
deleted
reply
I don’t know Java or the JVM, but if it’s anything like the CLR/.NET, this would either be compiled to atomic operations, or throw an exception.
reply
I suppose that if you create a map in one thread, and then access it from another thread, then that might cause segmentation faults? Because map is a type that is implemented in C.
reply
Yes, writing to maps isn't threadsafe, hence sync.Map
reply