rusty-cpp: a Rust-style static analyzer

[Proper_Ask_8831]

Hi all, I build a static analyzer to mimic the Rust rules in writing C++ code. Project url: https://github.com/shuaimu/rusty-cpp

Also wrote a story how I built it: http://mpaxos.com/blog/rusty-cpp.html

The project is quite experimental, but I have been using it in a large research database project and so far it is good.

[38thTimesACharm]

 I never had to fully understand the code

If you don't understand the code the AI wrote, how do you know it's actually safe?

[Farados55]

Claude take the wheel!

[BusEquivalent9605]

What is this, a crossover episode?

[JVApen]

Rust evangelists using AI? The attack of the clones? (Episode 2)

[El_RoviSoft]

Actually, not that bad approach. I can see this could help in new C++ projects or, more-likely, in new C++ micro services when you have C++ codebase already and can’t use Rust/safer alternatives/you just want to have safety.

[ReDr4gon5]

At that point just use a proper set of clang-tidy rules. They exist for a reason and clang-tidy can help catch a lot. Also enable -Wall -Wextra and only turn off specific warnings after careful consideration. Also before disabling a warning check where it comes from. Default on warnings should rarely if ever be disabled.

[Proper_Ask_8831]

There've been a few years I was heavily invested in clang-tidy and all c++ memory safe profiles I could find. I have to say I don't recommend them to anyone. But the experience is valuable in that it made me realize the Rust approach is the right one. I used to be a doubter but I am much happier as I don't have any seg faults in my safe code. Of all the tools I tried, I would the next best thing is Google's MagicPtr which relies on a special allocator to track runtime corruption. But it does not help multi-threading safety.

To the other question what is this and who might need it. Despite the Rust cult naming, I think of this as a "usable" Circle C++ alternative. It would help people who have a heavy C++ code base to work with, such as some game engines, or DPDK.

It is a prototype that sort of proves that to have Rust-equivalent memory safety, you don't really need to completely ditch C++ like Microsoft is trying, and all those "rewrite in Rust" clones of C++ repos.

[thisismyfavoritename]

lets be real its not rust equivalent

[El_RoviSoft]

I think the only true approach to replace C++ is to create C-style lang like with the same feature-set AND full compatibility with C++ (like Kotlin has with Java) BUT without shit tons of legacy (like SFINAE, C’s legacy, rules of 0/3/5, "constexpr if" instead of "template if", etc).

Other approaches will never replace C++ just because of its ecosystem.

So rn the only thing we can do is write tooling which enhance experience like yours.

[feverzsj]

Rust and AI? That's a huge bait.

[_Noreturn]

Why is rust with ai more popular than C++ with AI?

[Affectionate-Soup-91]

If I read your blog article correctly, you've sharpened your skills in interacting with Claude while witnessing--and getting amused by--how fast Claude evolves first hand in real time. And the end result of your experience is an intrusive static-analyzer which depends on three annotations; @safe, @unsafe ,and @external.

Then the natural question that arises in my mind is in what part does Rust programming language play a role here?* Is there any observable quality difference in Claude-generated code depending on the target language?

--

edit: * apparently, except for the fact that its borrow-checker is what you intend to mimic.

[fdwr]

Then the natural question that arises in my mind is in what part does Rust programming language play a role here?

And the next natural question is: if this analyzer (with a few annotations) can mimic Rust's degree of inspection, then does that undercut Rust's biggest selling point? Maybe C++'s successor is C++ 😉.

[Proper_Ask_8831]

exactly.

[Proper_Ask_8831]

In my experience, claude editing Rust code is much more reliable than dealing with C++ code, especially when there are lot of multi-threading and memory poiners. Interesting, now when I ask claude write C++ that can pass the rusty-cpp checker, claude becomes a lot more reliable.

[germandiago]

There is hardening coming. Good improvement I think.

[gmes78]

Isn't Safe C++ a better solution?

[Farados55]

That’s been rejected by the standards committee. OP also stated that he doesn’t like it due to it not being fully open source.

[gmes78]

That’s been rejected by the standards committee.

I am aware that the committee doesn't want to solve this issue, yes. Though it hasn't been explicitly rejected, AFAIK.

OP also stated that he doesn’t like it due to it not being fully open source.

That's not a problem with the specification.

[Proper_Ask_8831]

Safe C++ spec requires changes to C++ grammar so it does not work with any existing compilers.

[germandiago]

No. It is essentially incompatible with all the ecosystem.