this post was submitted on 04 Aug 2024
202 points (96.8% liked)

Programming

17695 readers
296 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]



founded 2 years ago
MODERATORS
 

To accelerate the transition to memory safe programming languages, the US Defense Advanced Research Projects Agency (DARPA) is driving the development of TRACTOR, a programmatic code conversion vehicle.

The term stands for TRanslating All C TO Rust. It's a DARPA project that aims to develop machine-learning tools that can automate the conversion of legacy C code into Rust.

The reason to do so is memory safety. Memory safety bugs, such buffer overflows, account for the majority of major vulnerabilities in large codebases. And DARPA's hope is that AI models can help with the programming language translation, in order to make software more secure.

"You can go to any of the LLM websites, start chatting with one of the AI chatbots, and all you need to say is 'here's some C code, please translate it to safe idiomatic Rust code,' cut, paste, and something comes out, and it's often very good, but not always," said Dan Wallach, DARPA program manager for TRACTOR, in a statement.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 98 points 4 months ago* (last edited 4 months ago) (5 children)

"You can go to any of the LLM websites, start chatting with one of the AI chatbots, and all you need to say is 'here's some C code, please translate it to safe idiomatic Rust code,' cut, paste, and something comes out, and it's often very good, but not always," said Dan Wallach, DARPA program manager for TRACTOR, in a statement.

"This parlor trick impressed me. I'm sure it can scale to solve difficult real world problems."

It's a promising approach worth trying, but I won't be holding my breath.

If DARPA really wanted safer languages, they could be pushing test coverage, not blindly converting stable well tested C code into untested Rust code.

This, like most AI speculation, reeks of looking for shortcuts instead of doing the boring job at hand.

[–] [email protected] 65 points 4 months ago

It reeks of a consultant who sold upper management via a gated demo.

[–] cucumber_sandwich 12 points 4 months ago (2 children)

You would also port the tests, right?

[–] [email protected] 7 points 4 months ago* (last edited 4 months ago)

You would also port the tests, right?

Right... If they exist.

But that bit shouldn't be left to a hallucination prone AI.

[–] [email protected] 6 points 4 months ago* (last edited 4 months ago) (1 children)

You have tests?

Edit: guess could always use AI to auto generate tests /s

[–] cucumber_sandwich 3 points 4 months ago

I mean the parent comment mentioned tests...

[–] [email protected] 10 points 4 months ago (1 children)

I'm thinking they also want to future proof this.

The quantity of C devs are dying. It's a really difficult language to get competent with.

[–] [email protected] 3 points 4 months ago (1 children)

That's a really valid point.

load more comments (1 replies)
[–] [email protected] 6 points 4 months ago (1 children)

If DARPA really wanted safer languages, they could be pushing test coverage,

Or Ada...

[–] [email protected] 2 points 4 months ago

Ada is not strictly safer. It's not memory safe for example, unless you never free. The advantage it has is mature support for formal verification. But there's literally no way you're going to be able to automatically convert C to Ada + formal properties.

In any case Rust has about a gazillion in-progress attempts at adding various kinds of formal verification support. Kani, Prusti, Cruesot, Verus, etc. etc. It probably won't be long before it's better than Ada.

Also if your code is Ada then you only have access to the tiny Ada ecosystem, which is probably fine in some domains (e.g. embedded) but not in general.

load more comments (1 replies)
[–] [email protected] 62 points 4 months ago (1 children)

turning C code automatically into Rust...

Oh wow they must have some sick transpiler, super exciting...

With AI, of course

God fucking damnit.

[–] [email protected] 6 points 4 months ago (1 children)

You want Skynet? 'Cause that's how you get Skynet.

[–] [email protected] 2 points 4 months ago

Maybe, but it's gonna be more like SkyNet with electrolytes; it's what terminators crave.

[–] [email protected] 43 points 4 months ago* (last edited 4 months ago) (1 children)

Code works in C

Want to make it safer

Put it into a fucking LLM

You know sometimes I wonder if I'm an idiot or that maybe I just don't have the right family connections to get a super high paying job

[–] [email protected] 4 points 4 months ago* (last edited 4 months ago)

Too bad commenters are as bad as reading articles as LLMs are at handling complex scenarios. And are equally as confident with their comments.

This is a pretty level headed, calculated, approach DARPA is taking (as expected from DARPA).

[–] bruhduh 43 points 4 months ago (1 children)
[–] SoulSkill 2 points 4 months ago

On a bit serious note, flux.1 model is pretty good…

[–] antihumanitarian 32 points 4 months ago

Key detail in the actual memo is that they're not using just an LLM. "Wallach anticipates proposals that include novel combinations of software analysis, such as static and dynamic analysis, and large language models."

They also are clearly aware of scope limitations. They explicitly call out some software, like entire kernels or pointer arithmetic heavy code, as being out of scope. They also seem to not anticipate 100% automation.

So with context, they seem open to any solutions to "how can we convert legacy C to Rust." Obviously LLMs and machine learning are attractive avenues of investigation, current models are demonstrably able to write some valid Rust and transliterate some code. I use them, they work more often than not for simpler tasks.

TL;DR: they want to accelerate converting C to Rust. LLMs and machine learning are some techniques they're investigating as components.

[–] [email protected] 25 points 4 months ago (1 children)

It'd be nice if they open source this like they did with ghidra. The video game reverse engineering and modernization efforts have been much easier thanks to the government open sourcing their tools

[–] [email protected] 3 points 4 months ago

Ghidra is open source?! How did I miss this!

[–] [email protected] 21 points 4 months ago (1 children)
[–] [email protected] 22 points 4 months ago (3 children)

I threw some simple code at it and it even put unsafe on the main function, what's the point of Rust then if everything is unsafe?

[–] [email protected] 7 points 4 months ago (1 children)

For all of our sake, I hope humans are the final set of eyes before the code is used in prod.

load more comments (1 replies)
[–] [email protected] 6 points 4 months ago

Ideally you don't directly ship the code it outputs, you use it instead of re-writing it from scratch and then slowly clean it up.

Like Mozilla used it for the initial port of qcms (the colour management library they wrote for Firefox), then slowly edited the code to be idiomatic rust code. Compare that to something like librsvg that did a function by function port

[–] [email protected] 6 points 4 months ago

Baby steps. It's easier to convert code marked unsafe in Rust to not need unsafe than it is convert arbitrary code in other languages to Rust code that doesn't need unsafe.

[–] [email protected] 21 points 4 months ago* (last edited 4 months ago) (3 children)

This is an interesting application of so-called AI, where the result is actually desirable and isn't some sort of frivolity or grift. The memory-safety guarantees offered by native Rust code would be a very welcome improvement over C code that guarantees very little. So a translation of legacy code into Rust would either attain memory safety, or wouldn't compile. If AI somehow (very unlikely) manages to produce valid Rust that ends up being memory-unsafe, then it's still an advancement as the compiler folks would have a new scenario to solve for.

Lots of current uses of AI have focused on what the output could enable, but here, I think it's worth appreciating that in this application, we don't need the AI to always complete every translation. After all, some C code will be so hardware-specific that it becomes unwieldy to rewrite in Rust, without also doing a larger refactor. DARPA readily admits that their goal is simply to improve the translation accuracy, rather than achieve perfection. Ideally, this means the result of their research is an AI which knows its own limits and just declines to proceed.

Assuming that the resulting Rust is: 1) native code, and 2) idiomatic, so humans can still understand and maintain it, this is a project worth pursuing. Meanwhile, I have no doubt grifters will also try to hitch their trailer on DARPA's wagon, with insane suggestions that proprietary AI can somehow replace whole teams of Rust engineers, or some such nonsense.

Edit: is my disdain for current commercial applications of AI too obvious? Is my desire for less commercialization and more research-based LLM development too subtle? :)

[–] [email protected] 36 points 4 months ago* (last edited 4 months ago) (2 children)

The problem I see here is that AI may write code that does compile, but has a bunch of logical errors, edge cases or bad architecture. From personal experience, even though AI can write small amounts of good code, it's bad at understanding big and complex solutions.

At that point, fixing the AI codebase might take longer than just starting with a competent Rust dev.

[–] mke 24 points 4 months ago (5 children)

This is a timely reminder and informative for people who aren't aware that LLMs don't actually understand anything. At all.

That doesn't mean they're useless, but yes, if you want an LLM to handle complex input and use it to generate complex output correctly... You may need to reevaluate your choice of tooling or your process.

load more comments (5 replies)
[–] [email protected] 5 points 4 months ago

It's unclear that AI is the right tool at all. It's certainly possible to use some automated conversion libraries, and then have human programmers fill in the gaps.

[–] [email protected] 21 points 4 months ago

so-called AI

knows its own limits

frustration noises It knows nothing! It's not intelligent. It doesn't understand anything. Attempts to keep those things acting within expected/desired lines fail constantly, and not always due to malice. This project's concept reeks of laziness and trend-following. Instead of a futile effort to make a text generator reliably produce either an error or correct code, they should perhaps put that effort into writing a transpiler built on knowable, understandable rules. ... Oh, and just hire a damn Rust dev. They're climbing up the walls looking to Rust-ify everything, just let them do it.

[–] [email protected] 7 points 4 months ago

So a translation of legacy code into Rust would either attain memory safety, or wouldn’t compile.

They'd probably have to make sure it doesn't use the unsafe keyword to guarantee this.

[–] [email protected] 12 points 4 months ago

Thirty percent of the time it works all of the time!

[–] someguy3 9 points 4 months ago* (last edited 4 months ago) (5 children)

Can someone explain more of the difference between C and Rust to a non programmer?

[–] [email protected] 20 points 4 months ago (2 children)

There is a ton of literature out there, but in a few words:

Rust is built from the ground up with the intention of being safe, and fast. There are a bunch of things you can do when programming that are technically fine but often cause errors. Rust builds on decades of understanding of best practices and forces the developer to follow them. It can be frustrating at first but being forced to use best practices is actually a huge boon to the whole community.

C is a language that lets the developer do whatever the heck they want as long as it's technically possible. "Dereferencing pointer 0?" No problem boss. C is fast but there are many many pitfalls and mildly incorrect code can cause significant problems, buffer overflows for example can open your system to bad actors sending information packets to the program and cause your computer to do whatever the bad actor wants. You can technically write code with that problem in both c and rust, but rust has guardrails that keep you out of trouble.

[–] Anticorp 16 points 4 months ago (5 children)

But if they have fully tested and safe C, and they're converting it to Rust using AI, that seems more dangerous, not less.

[–] calcopiritus 4 points 4 months ago (2 children)

Just recently a bug was found in openssh that would let you log into the root user of any machine. With extreme skill and luck of course, but it was possible.

OpenSsh is probably one of the most safe C programs out there with the most eyes on it. Since it's the industry standard to remotely log in into any machine.

There is no such thing as fully tested and safe C. You can only hope that you find the bug before the attacker does. Which requires constant mantainance.

The the about rust is that the code can sit there unchanged and "rust". It's not hard to make a program in 2019 that hasn't needed any maintainance since then, and free of memory bugs.

load more comments (2 replies)
load more comments (4 replies)
[–] someguy3 5 points 4 months ago (1 children)

That's a pretty good explanation. So along the same level of explanation, what are these memory problems they are talking about?

[–] [email protected] 13 points 4 months ago (1 children)

I explained a little about buffer overflows, but in essence programming is the act of making a fancy list of commands for your computer to run one after the other.

One concept in programming is an "array" or list of things, sometimes in languages like C the developer is responsible for keeping track of how many items are in a list. When that program accepts info from other programs (like a chat message, video call, website to render, etx) in the form of an array sometimes the sender can send more info than the developer expected to receive.

When that extra info is received it can actually modify the fancy list of commands in such a way that the data itself is run directly on the computer instead of what the developer originally intended.

Bad guy sends too much data, at the end of the data are secret instructions to install a new program that watches every key you type on your keyboard and send that info to the bad guy.

[–] someguy3 6 points 4 months ago

Many thanks.

[–] [email protected] 7 points 4 months ago

In C you can do almost anything, including things that will fry the system. In Rust, it's a lot harder to do that. (This makes sense if you consider when the languages were made and what were made for. It's not an attack on or praise for either language.)

[–] ZILtoid1991 6 points 4 months ago (1 children)

C: Older systems developing language, pretty much industry standard to the point the C-style syntax is often a feature of other languages. Its biggest issues include a massive lack of syntax sugar, such as having to do structTypeFunction(structInstance) rather than structInstance.function() as standard in more modern languages, use of header files and a precompiler (originally invented to get around memory limitations and still liked by hard-core C fans, otherwise disliked by everyone else), and lack of built-in memory safety features, which is especially infamous with its null-terminated strings, often being part of many attack vectors and bugs.

Rust: Newer memory-safe language with functional programming features, most notably const by default, and while it does use curly braces for scopes (code blocks), the general syntax is a bit alien to the C-style of languages. Due to its heavy memory safety features, which also includes a borrow checker, not to mention the functional programming aspects, it's not a drop in replacement language for C to the point you pretty much have too reimplement the algorithms in functional style.

[–] [email protected] 1 points 4 months ago (1 children)

I can somewhat see the issue with memory safety, but the other issues are fine by me.

[–] ZILtoid1991 2 points 4 months ago

Even then, D would be a better drop-in replacement, especially in BetterC mode, since it has a currently optional memory safety feature, which is planned to be less optional in a possible Version 3. I personally only have ran into an issue that would have been solved by a "const by default" approach (meaning a function had an unintended side effect, for which the functional approach is to disallow side effects as much as possible), but it would be extra annoying for my own purpose (game development).

The biggest fixer of "unintended side effects" is memory safety, since you won't have memory overwrites.

load more comments (2 replies)
[–] [email protected] 2 points 4 months ago

Using an LLM to come up with function names for transpiled code would be a good idea, but other than that. Nope.

load more comments
view more: next ›