Blog 17.2.2023

Why Gofore is sponsoring Rust 101?

Competence

Goforean sitting on a windowsill with a laptop on their lap.

Gofore is sponsoring the authoring of an open source university course for teaching the Rust programming language alongside Slovak University of Technology (STU) in Bratislava and Rust Foundation. The course is taught at STU this Spring.

Why Rust?

At the time I’m writing this, Rust is almost unused at Gofore. Almost all programming languages seem more relevant than it does when looking at statistics. We seem to have ample people ready for projects in it though. If we only look at the current trend in our business, Rust is barely a blip on the radar and if we look strictly at our current projects, everybody should learn JavaScript, TypeScript, Java, Python, C#, C or C++ depending on their specializations. So why should we pay attention to it now?

Rust is rising, fast. Google, Microsoft, AWS, Dropbox, Cloudflare, Meta, NPM, Discord, Linux and others are already transitioning more or less vital parts of their architecture upon it. Its developer community is growing by leaps and bounds. But is it relevant for us?

I see three rising trends in our software development business driven by external factors:

Sustainability: Driven by the climate and energy crisis. Green coding is already here and increasingly desired by our clients. We need to make our information infrastructure energy-efficient in order to decrease our carbon footprint.

Security: Driven by the more tense geopolitical situation and increasing hacking pressure on information systems.

Reliability: Driven by increasing complexity and interconnectedness of society. As society grows ever more interconnected through increased digitalization, a single part failing or misbehaving can have disastrous consequences.

How does Rust fare in each of these categories?

Sustainability

Rust is fast and efficient. AWS did a post on this, though it references a paper that’s been criticized quite a bit. Basically performance implies sustainability and half of top 10 of TechEmpower web backend benchmarks are Rust frameworks. This is just half the story though. Rust programs tend to require a lot less memory than many competing languages, save maybe for Go or C/C++ while providing as good or better results. In addition, Rust’s strict correctness requirements mean less failed CI builds, less need for testing corner cases and faster test runtime, decreasing the footprint of testing as well. This all leads to Rust having a really good baseline for creating products and services that check all the boxes for sustainable development.

Security

Rust is already taking root in the security world. Where memory vulnerabilities are concerned, Google Security Blog indicates that when Rust use goes up, vulnerabilities go down. They’re not the only ones to applaud Rust’s impact on software security. For example Software Engineering Institute, Microsoft Security Response Center, SDxCentral and Wired have written about it.

Rust does not eliminate security issues, but it does tend to decrease the attack surface and encourage a more deliberate method of programming. It’s not an automatic categorical win by any means, but there is evidence to support the claim that using Rust has security benefits, especially when compared to languages which can produce memory safety or undefined behavior related issues.

Reliability

This is more a personal experience than something I have sources for, but I’m generally a lot more confident about my Rust code than what I produce in any other language. I’m not entirely certain as to why this is, but the fact that the code also seems to work correctly more often on the first run seems to point to there being something there. Maybe it’s the strict type system, enforcing correctness. Maybe it’s the compiler-enforced handling of errors and sharing of resources. Maybe it’s the more deliberate programming style Rust requires making me think through the problem. I’d like to provide good references here, but the fact is they’re hard to find. Not “it’s hard to find cases that show benefits” but “it’s hard to find documented comparisons at all”. Ask people who have written a lot of Rust. There’s also the fact that Rust doesn’t have any undefined behavior unless you include explicit unsafe blocks.

Rust also has a somewhat rare feature of being a modern language applicable to almost any software project from embedded software running on bare metal to web frontends, from mobile to desktop to cloud, from games to high performance processing, from machine learning to entire operating systems. Some of those are not mature fields yet, but each have vibrant communities working on getting there.

You can use JavaScript almost anywhere, but it’s not a great fit for e.g. resource-constrained environments. You can run Java or C# almost anywhere, but their required runtime makes them an ill fit for something you ship to end users like WebAssembly. With Rust, you don’t really have inherent platform constraints like this. You should be able to drop down to whatever level you need to get exactly the result you need, same as with C, but in a much nicer package. Even if you mainly use some other language, Rust is highly embeddable and great at embedding others as well), so you can just make small parts of your project in it. You might already have Rust in your code base and don’t even know about it.

Rust seems hard

It is widely recognized that Rust has a high induction cost. It’s not a quick language to learn. But I posit it’s not a hard language to learn either, it’s just different from what developers have gotten used to and as such it feels harder for experienced programmers who find themselves having to learn fundamentals instead of just some new syntax. If you just take the time to actually learn how it works, you’d be surprised at how fast it is to learn more and get things done.

In the Rust Survey 2021 (still waiting for 2022 results) 83% of those who have adopted Rust at work found it to be “challenging”. However, during adoption only 13% of respondents found the language was slowing their team down and 82% found that Rust helped their teams achieve their goals. After adoption, only 1% of respondents did not find the challenge worth it while 79% said it definitely was. When asked if their teams were likely to use Rust again in the future, 90% agreed. Finally, of respondents using Rust at work, 89% of respondents said their teams found it fun and enjoyable to program.

So, while the initial cost is high, it does seem to be worth it.

What if it never pans out?

Okay, say we buy into the hype and all learn Rust. Then it turns out the world doesn’t agree and nobody uses it in a few years. Is it all for nothing then? Again, this is anecdotal but I don’t think so. Rust has probably permanently changed how I view code, especially regarding ownership, expressing intent through types and striving to make mistakes as unrepresentable and as visible as possible. I use Rust-style thinking when I code Python now and I think it has made a difference. I certainly suspect members of my project team have noticed a steadily increasing number of pull request comments regarding corner cases and error handling. If nothing else, you gain a valuable new perspective.

I’m very much aware the language is not a best fit for everyone, but I do think it’s the best way for anyone to improve upon all these points at once.

So why is Gofore sponsoring Rust 101 now?

Rust’s biggest hurdle is succinctly expressed in the Rust 101 announcement blog post. It’s the vicious cycle of