Josh Matthews - An Introduction To Rust

--People are not important --

--There are no people in technology,
just replaceable components --

(Laughter)

Alright let's do this.

Alright, I'm going to tell
you about what Rust is,

why Rust is a part of Mozilla's work

and when it's going to start
being a part of Mozilla's work.

Let's begin.

So Rust is a new programming language

that has been created inside Mozilla

and shared with the outside world.

The goal of it

is basically

anytime when you traditionally

as a developer have

reached for C++

because you needed certain guarantees
about performance for example

we want Rust to be a viable alternative

in every single case.

There should be no reason to choose C++

over Rust

in the ideal future.

So it began as a side project

of a Mozillian named Graydon Hoare

back in before 2009.

He started working on it full-time

in 2009

because Mozilla saw the
ideas that he had and said

"We can see how we
could put this into Firefox...

...and make the product better
if we actually had this language".

So that's when we started investing
time and resources into it.

Fast forward a few years

we now have a team under
the Mozilla Research umbrella

who's working full-time
on improving the language

and we released
version 1.0 last year

and every 6 weeks we
now release a new version

so we just released 1.13

and there is a large community

around the language now

so not only do we have developers

working in Mozilla on it

some of those developers are part
of what's called the Core Team

and those are the people that
decide the future of the language

and help shape where
it's going as time goes on

so in addition to our employees

we have volunteers

and employees from other companies

that are now depending on
Rust for their products

and they're helping shape this ecosystem

which then has a large number of libraries

that are being developed by people

who are enthusiastic about the language

it's got a lot of downloads happening
since the last time I gave this talk

there've been 10 million more downloads
and 300 new libraries published

so there's a lot going on,
there's also the friends of Rust

which I'll show you

there is a page showing lots of different
companies that've told us

"Yes, we are relying on
Rust in production...

...we are very excited
about its prospects".

So, lots of cool things going on there.

So the reason for Rust

is that we have in the past

what 10 or more years of using Firefox

and Javascript in Firefox

sorry C++ and Javascript in Firefox

we've come across the fact that

there are some pervasive problems

that are caused by using C++

that is writing code that
makes use of local threads

is very difficult

it's easy to write incorrect code

and it is very easy to write
code which is unsafe

and that translates into

security exploits

things that are stored by governments

and by hackers

all over the world

and used to

steal data from users

and take over their computers

using the browser as a vector.

There's a huge number of these
that are released every year

by security investigators

and there's competitions showing

who can pwn a browser the quickest.

So we looked for ways to address this

by creating a new language

and it turns out

that actually both of these issues

make it difficult to write parallel code

that makes use of modern hardware

and writing code that is
safe and not exploitable

turns out they can both be addressed

by introducing the concept of
Ownership in the language.

So let's talk about what that means.

Ownership encapsulates two ideas basically

it is what the owner of a value is

and whether there are
multiple owners of a value

or mulitple users that are sharing a value

and additionally when that
value is actually valid.

What is the point in the program

in which it's actually safe
to interact with the value.

And so from this we can derive a few rules

that if there is only a
single owner for a value

that value can be destroyed
when the owner goes out of scope

because there are no ways to
reference that value anymore

similarly if a value
has only a single owner

that means that it is legal to mutate it

because no one can observe
the change to that value

and finally

if you have multiple owners

you need to have

something called Borrowing

which is, you still have a single owner

but other people can observe it

but it cant be changed during that time.

So let's talk about an analogy here,

if I've got a colouring book and a marker

and some friends

we can establish some rules

the colouring book and
the marker are my property

so they go with me wherever I go

if I leave no one else can
observe the book

or colour in it

however I am able to loan
the book to someone else

and that means they're
borrowing it from me

that also means that I can't colour
in it while they're borrowing it

because that's rude

so they can also choose to
lend it to people around them

but that means that if
anyone else is borrowing it

they need to give it back
to me before they leave

because it's my property

and only I can leave with it.

Additionally,

if I have the marker

I'm able to colour in the book

if I have the book

I can also give the marker to someone else

and that means they can colour
in the book if they have it

but that means that I'm
no longer able to colour

because there's only a single marker.

And finally,

if I want to leave but I dont actually
have the book in my posession

there's a problem, either I need to wait
until someone gives me the book back

or I need to actually give
it to someone else and say

"OK, it's not my property anymore,
...it's yours to deal with".

So Ownership in Rust.

If we have a type we call a ColouringBook

and it gives us a constructor

that returns a new instance
of a ColouringBook.

We can say OK,

here is a variable called a Book

which we will say

stores this ColouringBook value.

That means that we can now

call this Colour method

which will change the
Colouring Book in some way,

it'll colour in it.

That's fine, we can mutate it

because we only have a single owner.

So what happens if

someone borrows the Book?

We now have another variable
called Borrowed Book

and we use the ampersand

to show that we are borrowing the value

that's stored in this value called Book

- this variable called Book.

This is an Immutable Borrow.

That means that it is not possible

to mutate the original value anymore

because it's borrowed.

So we cannot colour in the book

while it's borrowed by someone else.

This follows our analogy.

The other thing however

is that if someone else is
borrowing the book,

they also cannot colour in it.

They don't have the marker.

In this case they only have
an Mutable Borrow

so they cannot mutate it.

So we can work around this

by using what's called a Mutable Borrow.

This says OK,

give me the book and
give me the marker

and then they have both those elements

necessary in order
to actually colour in it

and mutate it in this case.

So we have the ampersand

followed by the Mute keyword

and this means

give me a Mutable Borrow

to the value that follows.

However the thing to note here

is that we cannot use
the original variable

called Book

in order to mutate it while it's borrowed.

We cannot have two different
people colouring in it

because only one person
can colour at a time.

So let's go back to the
example we had before.

So we've got a Book value

we're allowed to colour in it

because there's no one borrowing it

then on the next line

we have an Immutable Borrow

and we're not allowed to colour

in the original one again

this is fine

it's borrowed

it can't be coloured in.

So let's fix this

this is where we talk about lifetimes

because remember how I said that

we can figure out
when a value is valid?

So this means that if we have a scope here

deliniated by

the curly braces

this means that inside the curly braces

anything that is unique inside there

no longer exists outside of them.

So if we create this Borrowed Book value

and we borrow from the Book value

we have a Mutable Borrow

and that's fine

we can then do something with this

that doesn't require mutating it

we can just look through the
Book, we can investigate it,

and that doesn't mutate it, that's fine.

And so previously calling Colour
on the original Book value

would've been an error

because it was borrowed

but now the borrow no longer exists

because it is only valid within
the scope of these braces.

This is how we can control

the scope of a Borrow.

So finally we can also transfer Ownership.

This is how we talk about giving
away the Book to someone else.

By default we can say OK,

we'll create a new variable called Book 2

and it will have the contents
of the Book variable

and we can now colour in Book 2.

That's fine, it's not a borrow
there's no ampersand there

we are giving control of the value

to another variable

and additionally

if you try to compile this
you'll note that

we can no longer interact
with the Book variable

because we transfered Ownership

it doesn't exist anymore

the compiler knows this and can say

"Nope, that is not safe
what you're trying to do".

And you'll note the link up here
actually goes to a playground

where you can play with the
Rust compiler in your browser

and there's a sample for this code
that you can experiment with there

already prepared for you.

So

we understand Borrowing
a little bit better now

especially with the analogy

but how does this
actually help in practice?

How does this address the two
cases we talked about before?

Using values after they're no longer valid

and writing code that works with
multiple threads at the same time.

So first

with Use-after-free problems

those happen in C++

because you'll have pointers in your code

but the pointers are not associated

with the value they're pointing to.

So you could delete

the memory that they're pointing to

but the pointers are still
pointing at that memory

and so if you aren't careful
you can end up using pointers

that are pointing to invalid memory.

So in Rust

the compiler is actually tracking this

so it doesn't let you write code

that has the potential

where pointers could point at
memory that no longer is valid

and that means that

you're always taking
borrowed pointers to values

where the compiler says

"OK. I know exactly how
long this value is valid for...

...because I know what the owner
is and therefore any pointers to it...

...must no longer exist before
the owner no longer exists"

and additionally

you can also

because the Rust compiler also
tracks outstanding Borrows

you can also say

"OK, we are guaranteed that
there's no way to mutate this...

...while anyone else is borrowing
and trying to look at the value"

and this addresses another case

where this can happen in C++

where you end up changing the value

like reallocating a pointer or something
while other things are trying to point to

memory that it was relying on

and as for parallel code
with multiple threads

the issue arises with Data Races

where you have multiple threads

that are sharing values and
they're also mutating them.

It's the same issue we
just talked about basically

where they're not
coordinated in figuring out

when it's safe to write to a value and
when it's safe to read from a value

because you might get intermediate values

when the write hasn't completed yet.

So Rust addresses this by forcing you
to either transfer ownership of values

that another thread needs to use

so that two threads cannot
share the same value

or

ensuring that any values that you
do share between the threads

abide by certain restrictions

that prevent invalid writes from happening

and invalid reads from happening

so that races can't happen

and it's impossible to write code that
is not actually thread safe.

So

how this actually applies

to what we're doing at Mozilla

is that we've got the Mozilla
Research organisation

and so part of them are working
on improving Rust the language.

However another part of them

are working on building a
brand new web browser

because Firefox is not enough.

This one's called Servo

and so we're building it
from the ground up

and the reason we're doing this is that

there are decisions that were made

design decisions for Firefox

that were made a decade ago

which are very difficult to
change at this point in time

it'd be a huge amount of work

to redesign parts of Firefox
we think could be better

but it's also difficult

to verify whether that would be

a worthwhile use of time
without actually doing it

so we compromise by creating
a brand new browser

where we can actually try out new ideas

and give ourselves a playground
to experiment with things

we could do better in Firefox
and if they work out great

we can then start transferring them
back into Firefox and integrate them

and additionally

this means that we can experiment

with letting out pages

doing that in parallel

rather than all other browsers today

which do them sequentially
and single-thread

we can do things

like experiment with the way

that we

redraw things to the screen

and do it more like a computer game

we can do things like change the way

that we're managing memory

for the parts of the web page

so that it's more integrated
with the garbage collection

that the Javascript code

ends up ineracting with

so all of this are things
that we're doing in Servo

and we're getting some great results

and some of them are already

being integrated back into Firefox.

So we're already shipping foot code today

in Firefox that's written in Rust.

For example we have parts
of our Media Stack where

we have code that's just responsible
for reading parts of video files

which has been a source of security
vulnerabilities in the past

and there's no reason
that should be the case

so we rewrite it in Rust

and we get safety by default.

So that's shipping in Firefox today.

We've also got a project called Oxidation

which is a list on the wiki

of all the pieces that
we're in the process

of writing in Rust in Firefox today

some of the most challenging ones

that I mentioned previously

the Rendering Engine

the Style System and Layout

those are being integrated
into Firefox today

as part of the Quantum Project

and so you can basically expect that

the amount of Rust code in Firefox

will increase over time

there's been a lot of really good
results panning out so far

especially for areas where

they shouldn't be security sensitive

that they need to be high performance

those could be great places

for integrating Rust code

because you've got those by default

so if you'd like to know more about Rust

and Mozilla

you can check out the Rust
Playground I mentioned earlier

that allows you to experiment
with writing Rust code

in your browser

we've got a nice introductory book

that covers everything you need
to know about the language

called The Rust Programming Language

which is accessible from the language
website and we've got IRC channels

which are designed for both beginners
who like to interact with other people

who really want to answer
your questions right there

as well as a huge community
in the Rust channel

who really adore asking
and answering questions.

That's all.

Thank you very much.

[Applause]

Any questions?

Yes

What would be a good way to
start contributing or participating?

There's a few ways

so if there are

let me see

if there are libraries that you
would like to use from Rust

that don't exist yet

writing either libraries
from scratch in Rust

to scratch that itch

very handy

publishing that for the community

or if there are libraries
written in C which already exist

which would give you functionality
but don't exist in Rust yet

then writing bindings in Rust

around a C library

is very useful

because that allows you to
build safer abstractions

on top of things that would
otherwise be potentially unsafe

but is really easy to
integrate with C code

which is one reason why it's working
out so well to integrate Rust in Firefox.

There's lots of other suggestions
on the Rust website

of ways to participate in
the Rust Community

if that's what you're asking.

Yes Lucy?

What are the most compelling
reasons for someone to learn

the language and potentially start
participating and contributing?

One thing I've heard
is that actually people

who don't already have what's called

systems programming experience

so a lot of experience
using C++ for example

one of the lower level languages

people coming from a web
development background

people writing a lot of
Javascript, Ruby, Python

what I've heard is that people
coming from those languages

are actually getting
their first experience

doing low level programming stuff

but in a way which is much less daunting

than C or C++

where they know that the
compiler has their back

in ways that the compilers
for C++, for example, don't

and it will tell you when
you're making mistakes

and it won't let you make those mistakes

which is pretty exciting.

There are two people who I know

who come from Ruby

Javascript backgrounds

who are now putting together

a series of tutorials

for teaching people how to do
kernel programming using Rust

with the intention that other
people are coming from those

high level backgrounds

and trying this out for the first time

so there's a lot of ways to experiment
with things that traditionally has been

rather unapproachable

for large segments of the
developer population.

Pretty compelling reason really

and even if you do have
experience doing C++

and lower level things like that

I find that not having to worry
about whole classes of problems

you can make

as a developer in those languages

makes a huge difference

it allows you to reason
about your code better

it allows you to be more
adventurous with your code.

(Inaudible audience discussion)

So the questions was

one of the things people have talked about

is that Rust should be able to make
the process of refactoring your code

easier, safer, generally less complicated

and less uncertain

and has there been talk of that

has there been evidence of that

and yes

there's actually a really great blog post

in the past couple weeks

of someone who was

refactoring their code

and the compiler kept pointing out
ways in which it would not be safe

to refactor it in that certain way

because it was shared between threads

like he would fix that thing

and it would go down the
rabbit hole a little bit further

and say "Oh now this isn't safe anymore".

and was this very compiler
guided refactoring session

which he wrote about

and documented top to bottom

and it's great, it seems to just

verify the premise

that this does prevent you
from making mistakes.

Alright let's call it there.

Thank you for attending everybody

[Applause]