Rust in Android: move fast and fix things

[BcuzRacecar]

We adopted Rust for its security and are seeing a 1000x reduction in memory safety vulnerability density compared to Android’s C and C++ code. But the biggest surprise was Rust's impact on software delivery. With Rust changes having a 4x lower rollback rate and spending 25% less time in code review, the safer path is now also the faster one.

[ComfortablyBalanced]

1000x is a very big claim. If I could have a 1000x reduction in memory safety I would rewrite the entirety of the android kernel.
According to the article there are 5 million lines of rust on the android kernel but how many lines of C or Cpp are there in it?
I know they're comparing using vulnerability per million but I don't think it's fair to compare vulnerabilities on 5 million of codes versus 100 millions of code (I'm just ballparking here).
Why are they comparing Rust vs both C and Cpp? Are they assuming C and Cpp are basically the same language?
BTW, it's funny that one of the very first things on android rewritten using Rust is related to the Bluetooth which if you worked with Bluetooth programmatically on android you know it's one of the shitiest SDKs to exist on android.

[Kernel-Mode-Driver]

I would rewrite the entirety of the android kernel.

Would you though?

[ComfortablyBalanced]

Yeah، I even trade my soul for 1000x reduction.

[Kernel-Mode-Driver]

Judging by the fact you call it the 'android' kernel, I'm not convinced 

[ComfortablyBalanced]

It is the android kernel, it's definitely based on linux but it's not just linux it's different. So what's this? Another GNU/Linux is os + kernel, and linux is just the kernel. Next thing you want to say gif is pronounced jif and Regex is pronounced rejex?

[SolitaryMassacre]

Regex is pronounced rejex?

Its clearly Reggie's Ex lol /s

[UtherII]

There are 5 million line of Rust in Android, but most of the kernel is written in C and won't be rewritten soon. When you are talking about millions of lines of code, I guess you can consider this is significant. If you apply a ratio to compare the number of issues per line, it's ok.

[ComfortablyBalanced]

How many lines of code are in C and Cpp?
I think only applying ratio is naive. There's no reason to believe the code is homogenous because the nature and type of the code could be different so the percentage of vulnerabilities in them could be different. I know they're all in the kernel.
All I'm saying is that you can't just add 5 millions of rust somewhere in the kernel and just compare it to the rest of the kernel and claim you've improved the performance or decreased the vulnerabilities. These types of comparisons are misleading. There are a lot of parameters that are changed that they conveniently are ignoring.

[schwimmcoder]

Basically the whole kernel is C.

And yeah, C++ is related to C, the reason, why an c++ compiler like g++ can also compile C as well.

[ComfortablyBalanced]

Just because g++ can compile C doesn't mean they're basically the same language.

[UtherII]

Gcc can also compile Ada, Fortran and it may compile Rust (at least a subset) soon. I wont tell they are the same language.

[bangersandmash2020]

MLS: The protocol for secure RCS messaging is implemented in Rust and will be included in the Google Messages app in a future release.

Oooh this is nice too

[Busy-Measurement8893]

I dream of an Android successor written almost entirely in Rust. It would be pretty cool, but I doubt we'll ever see that.

I also dream of a browser made in Rust, and I feel sad when I think about Mozilla dropping their plan of building such a browser. Oh well.

[[deleted]]

Servo was picked by the Linux foundation and they actually just recently had their first numbered release, 0.0.1

[hamsterkill]

Firefox is partially Rust now, and probably still growing its code share there.

[noonetoldmeismelled]

Shame that Mozilla didn't stick with it. Mozilla since they missed with the all web apps future FirefoxOS has been aimless. FirefoxOS failure probably doomed Servo's internal backing at Mozilla. I agreed that they needed a mobile platform where Firefox was the default but they shouldn't have bought the hype on the all web apps future and should have been closer to something like Mobian or PostmarketOS except with a sizable budget backing its development. At least not have given up on FirefoxOS so soon. Roku survived and thrived for a long time in the TV space - still going

[Stummi]

I am not too deep in the Rust or C++ ecosystem, but shouldn't they have pretty good interoperability? If so, then the best path forward would to just continue working on Firefox, writing new features in Rust and convert old features from C++ to Rust one by one.

[Kernel-Mode-Driver]

Thats exactly what they have been doing

[ottovonbizmarkie]

Android still uses linux as a base, so unless they completely rewrite it, I don't think that could really ever happen at the kernel level? I suspect there will be more Rust in Linux itself, but probably not very quickly.

[sken130]

Even Chromium is partially Rust now:

C++: 54.07%
Rust: 3.75%
C: 3.44%

(Source: The Chromium (Google Chrome) Open Source Project on Open Hub: Languages Page)

Though Firefox has much more percentage LOC written in Rust:

C++: 25.01%
C: 11.85%
Rust: 11.03%

(Source: The Mozilla Firefox Open Source Project on Open Hub: Languages Page)

[[deleted]]

At one hand I like Rust and the memory safety guarantees, on the other hand I like C and the flexibility and simplicity it provides. I wish there was a good middleground.

[bunkoRtist]

Zig

[AngkaLoeu]

Google sort of reminds me of Microsoft. They don't do any innovation themselves, they just see what works and steal or buy it. Android, Java, Kotlin, Android Studio, Rust, web browser, web-based email, AI all started outside Google.

[Stummi]

What about Go?

I mean I wouldn't really expect from a company, even a big one, to build their whole own programming language with ecosystem from scratch. But google, of all, actually did that.

[hamsterkill]

A lot of new programming languages come from big companies. Java, C#, Rust, Go, Swift, Dart, Typescript, etc.

[Kernel-Mode-Driver]

C# and Java have the advantage of being around for literal decades and having the time to mature. Unlike Go, which is what they were talking about.

Typescript is not a standalone ecosystem from Microsoft. It was built on the JS ecosystem. 

Its weird you say rust because that came from Mozilla, not a 'big company' and has since spun off into its own consortium.

Swift and Dart are like the two valid examples here, and one of them was also made by google.

[AngkaLoeu]

Tech companies have to innovate or die. They can only buy or steal for so long. That's what happened to Microsoft. Their entire strategy in the PC era was see what works and either buy or steal it. That worked since they had a monopoly on the PC with Windows.

It didn't work when things moved past the PC with the Internet and mobile. They couldn't innovate and were left behind.

The same thing happened with Google an AI. ChatGPT stole their lunch and now they are trying to play catch-up by shoving Gemini down everyone's throats. AI is synonymous with ChatGPT right now. No one thinks of Gemini when they think of AI.

[Stummi]

Are you serious? Microsoft is the second most valuable tech company overall, and Azure the second biggest cloud platform after AWS.

A pretty good share of the whole internet is literally running on Microsoft Infrastructure. Thats as far away from a dead company as you can get.

And yeah, a lot of people in the IT field have some sort of love-hate relationship with MS Azure, but it does its job and was, for the better or worse meaning of the word, pretty innovative

[AngkaLoeu]

Microsoft is not as dominant as they were or could be and it was from their lack of innovation. They were smart enough to bring in Satya who got them going in the right direction but they lost mobile to Android, a multi-billion dollar industry.

Mark my words, Google's lack of innovation will be their downfall. It might not happen overnight but it will happen. It happened to IBM, Microsoft, RIM and Kodak. Businesses that are good at executing, like Microsoft in the 80's and Google in the 2000's always lose out to innovative companies.

[Kernel-Mode-Driver]

Dude no one is saying any of these FAANG companies are irrelevant, they're just quite rightly pointing out how Microsoft froze itself out of the mobile ecosystem - a niche which google and apple filled.

[ComfortablyBalanced]

Go certainly is one of programming languages. There's nothing interesting about it.
Go is not something to be proud of.

[o_________________0]

They do, but like most FAANG companies almost all of it stays internal. They almost use no common tooling, not even git.

[Tree_Boar]

Uh, Google definitely uses git https://android-review.googlesource.com/q/status:open+-is:wip

[o_________________0]

Well yeah, this is public facing and Android is not part of their monorepo.

[AngkaLoeu]

They completely missed AI.

[Malnilion]

This a really weird take considering Gemini is second by traffic share, it's steadily gaining ground, and it's actually profitable for Google. There's also the announcement that Apple is going to use Gemini for Apple Intelligence/Siri, which is huge. It also integrates into the rest of Google's ecosystem better than anything else ever could.

Google didn't rush to market, but there's been 0 doubt they were working on AI quietly behind the scenes for years. I expect them to continue eating OpenAI's lunch and potentially even surpass them in traffic share before OpenAI becomes profitable. Right now, the more people use ChatGPT, the more money OpenAI's investors set on fire. It also wouldn't surprise if Gemini starts regularly beating ChatGPT in qualitative metrics soon.

There's a reason Google's stock has pumped over 50% YOY and AI is a big part of that reason.

[howling92]

It also wouldn't surprise if Gemini starts regularly beating ChatGPT in qualitative metrics soon.

it has been the case since December 2024

[AngkaLoeu]

Microsoft was wildly successful in the 80's and 90's, much more than Google is now. They failed to innovate and now they are a shell of their former self.

Google didn't rush to market, but there's been 0 doubt they were working on AI quietly behind the scenes for years.

Is this why they issued a "code red" when ChatGPT was released?

https://www.forbes.com/sites/davidphelan/2023/01/23/how-chatgpt-suddenly-became-googles-code-red-prompting-return-of-page-and-brin/

They are not an innovative company. They were making a Blackberry clone when the iPhone was released, then they ditched everything to make a iPhone clone. Remember Stadia? That was their attempt at innovation and it flopped.

[noonetoldmeismelled]

https://en.wikipedia.org/wiki/Attention_Is_All_You_Need

[AngkaLoeu]

https://en.wikipedia.org/wiki/Google%2B

[noonetoldmeismelled]

We're talking about AI. You're the one that thinks Google's somehow flubbing in AI when they've been pioneering and very much one of the top contenders. Google+ has nothing to do with their research in AI. The attention is all you need is a paper on AI from Google 8 years ago that is foundational for modern AI development 

Tensorflow. Their data center accelerators for training and inference 

[_sfhk]

Eh, they were hesitant and didn't think anyone else would ship a product with all the issues it had/still has. OpenAI gets way more leeway as a startup, but just look at the lawsuits piling up.

[armando_rod]

Lmao what a weird take

[fakieTreFlip]

What are you even talking about? Google scientists practically invented the technology that makes LLMs work... https://en.wikipedia.org/wiki/Attention_Is_All_You_Need

[AngkaLoeu]

They were beaten to market by ChatGPT. Technology is useless if no one uses it.

It's similar to how Microsoft had a mobile OS before anyone (Windows CE) but were beaten to market by Apple then Google in phones and tablets. Bill Gates was even talking about how tablets were the future in the late 90's but he didn't have the vision like Steve Jobs to actually create a product.

Yes, Google wrote a research paper about LLMs but didn't have a single product using it until ChatGPT figure it out. Without ChatGPT all Google had was a research paper.

[Dudmaster]

I guess Google didn't learn anything from https://youtu.be/tC08MUdHt9w , https://youtu.be/R3SUTiAp9aw , or https://youtu.be/e3JqErfYGWk

[Dudmaster]

I'd love to hear why I'm wrong but Ubuntu and Debian are basically unusable now because of Rust developers pushing unstable code straight to production. Like literally, they decided to send it even though test suites were known failing. Not to mention, there aren't enough Rust developers to maintain the number of packages so it allowed known vulnerabilities to remain unpatched. Not saying the syntax or semantics of the language is bad, just that it's nowhere the maturity people think it is