Price-Checking Zerocopy's Zero Cost Abstractions

2026-03-09T00:00:00+00:00

Zerocopy</a> is toolkit that promises safe and efficient abstractions for low-level memory manipulation and casting. While we’ve long done the usual (e.g., testing, documentation, abstraction, miri) and unusual (e.g., proofs, formal verification) to prove to ourselves and our users that we’ve kept our promise of safety, we’ve kept our other promise of efficiency with a less convincing combination of #[inline(always)]</code> and faith in LLVM.</p>



The Three Basic Rules of Safety Hygiene
2025-02-06T00:00:00+00:00

Ask not what you can do with unsafe</code>; ask what unsafe</code> can do for you.</em></p>
</blockquote>
On the Rust subreddit, I often see beginners get tripped up on unsafe</code>, posing questions like “What can I do in unsafe</code>?”</em> and “When do I need unsafe</code>?”</em>. These are useful questions — but not enough to really understand (un)safety. The former defies a simple, evergreen answer — as Rust’s operational semantics are refined, so too are what you can and cannot achieve with unsafe</code> code. The latter begets teleological answers; you need</em> unsafe when the sum of Rust’s tooling requires you use unsafe</code>. These answers are not particularly helpful for understanding how to write maintainable unsafe code, nor for informing how Rust’s safety tooling might be improved. They miss the forest for the trees; they mistake the implementation for the idiom.</p>
Let’s take a step back. Just as Rust’s borrow checker is the tooling that supports the idiom of ownership and aliasing xor mutability</em>, the sum of Rust’s safety tooling — a basket of keywords, well-formedness checks, and lints — is, too, the expression of a deeper idiom. In this essay, I give this idiom a name — safety hygiene</em> — and argue that it’s underpinned by three basic principles. In doing so, we gain a lens for understanding Rust’s myriad safety tools, opportunities for improvement, and its greatest flamewars.</p>


Undroppable Types
2024-11-25T00:00:00+00:00
In Rust, ManuallyDrop</code> is the tool of choice for eliding the destructor of a value. Wrapped in ManuallyDrop</code>, a value is simply forgotten when it goes out of scope. However, in some cases, it is useful to ensure that a value cannot</em> be dropped — not because it is forgotten, but because the very act of dropping it is a compilation error.</p>


Safety Goggles for Alchemists
2024-09-30T00:00:00+00:00
The Path Towards Safer Transmute</strong></em></p>
Since Rust’s inception, mem::transmute</code> has been the poster-dragon of unsafe code, but its reign of error is coming to an end! In this talk</del> blog post, you’ll learn how Rust is poised to become the first systems programming language with transmutation safety, and how safe transmute is already being put to use to build next-gen systems.</p>


`repr(C)`: Clear, Simple and (Sometimes) Wrong
2024-07-31T00:00:00+00:00
Too often, repr(C)</code> is thought of as a panacea to layout stability and portability problems; that values of a type marked repr(C)</code> can be consistently reflected upon, across different platforms, different compiler versions, and even perhaps different minor library versions. That is not always the case!</p>


Announcing `scoped-trace`.
2023-03-28T00:00:00+00:00
Today, I’m announcing scoped-trace</code>, a crate for capturing scoped, tree-like execution traces.</p>
Here are the crate’s important links:</p>

https://crates.io/crates/scoped-trace</a></li>
https://docs.rs/scoped-trace</a></li>
https://github.com/jswrenn/scoped-trace</a></li>
</ul>


Oh the Crates You'll Go! A 2022 Retrospective
2023-01-04T00:00:00+00:00
As my first full calendar year in the Rust Platform Team at AWS draws to a close, I thought it might be illuminating to reflect on what I worked on. The breadth of crates I released or contributed to surprised me! Time really does fly when you’re having fun.</p>


Native Reflection in Rust
2022-12-15T00:00:00+00:00
Today, I’m releasing deflect</strong></em>, an implementation of reflection</a> for Rust. Deflect can be used to recover the concrete types of trait objects, inspect the internal state of async</code> generators, pretty-print arbitrary data, and much more.</p>


Typesetting a Resume with HTML and CSS
2021-01-29T00:00:00+00:00
With my PhD drawing to a close, I’m on the job market! I’ll need a slick resume ASAP, but how to typeset it?</p>

  Microsoft Word?</dt>
  
...don't have it.</dd>
  
LaTeX?</dt>
  
...don't have the patience for it.</dd>
  
HTML + CSS?</dt>
  
...now that</em> could work!</dd>



Rust's SemVer Snares: `repr(transparent)` Super-Cut
2021-01-09T00:00:00+00:00
(Part of an ongoing series!)</em></a></p>
In the last two posts, repr(transparent)</code> provided an unusual mechanism by which safe, downstream code could inadvertently rely on the size</a> and alignment</a> of an upstream type. In this post, I’ll recap the issue and discuss why it is tricky to fix.</p>


Rust's SemVer Snares: Alignment
2021-01-06T00:00:00+00:00
(Part of an ongoing series!)</em></a></p>
In Rust, changes to a type’s alignment are not usually understood to be Breaking Changes™. Of course, that isn’t to say you can’t</em> break safe, downstream code by changing the alignment of a type…</p>


Rust's SemVer Snares: Sizedness and Size
2021-01-05T00:00:00+00:00
(Part of an ongoing series!)</em></a></p>
In Rust, changes to a type’s size are not usually understood to be Breaking Changes™. Of course, that isn’t to say you can’t</em> break safe downstream code by changing the size of a type…</p>


Rust's SemVer Snares: Introduction
2021-01-03T00:00:00+00:00
At the heart of Semantic Versioning</a> is a distinction between incompatible API changes (“breaking” changes) and backwards-compatible API changes (“non-breaking” changes). When you make a change that could break existing code, you must increment the MAJOR</code> component of its version number. Since failing to do this correctly may cause builds or tests to fail seemingly-spontaneously, knowing what kinds of changes are breaking and which are not is crucial to good crate hygiene.</p>


How does Brown University know where you are?
2020-12-05T00:00:00+00:00
In September 2020, Brown University accused students</a> of lying about their location; e.g.:</p>
</img></p>
What was Brown’s basis for these accusations?</strong></p>


Brown’s Most Expensive Books
2020-11-28T00:00:00+00:00

What’s the most expensive required textbook at Brown?</li>
What’s the most expensive class?</li>
What’s the most expensive department?</li>
</ul>


How Many First-Years Are Taking Their Free Course?
2020-10-20T00:00:00+00:00
To de-densify campus, Brown University moved to a three-term model</a> in which students take courses for two</em> of three possible terms. This third term will be carved out of the summer months of 2021, during which an unlucky subset of the student body will swiftly discover that Brown does not</em> air-condition its dorms. So, who are these unenviable souls? Well, first-years, obviously</em>, who will begin in the spring semester and continue through the summer.</p>
To compensate them for this inconvenience, Brown has extended all first-years the opportunity to remotely take one course this Fall, for free! How many took Brown up on this offer?</strong></p>


Brown’s Class Size Paradox
2020-10-19T00:00:00+00:00
University Admissions departments love to brag about their schools’ small class sizes. Brown University, for instance, boasts</a> a 7:1 student–faculty ratio (so “you’ll have a lot of face-to-face time with some of the best researchers and teachers in academia”) and that “72 percent of our undergraduate classes have fewer than 20 students.” These claims invite prospective students to daydream of cozy, intimate classrooms, and personalized learning experiences — dreams quashed (or perhaps squished?) on one’s first day of classes.</p>
Nobody is lying, per se</em> — this is merely an instance of the “class size paradox”: the size of the average class is relatively small, but the experience of the average student suggests otherwise.</p>


Scoped Trait Implementations
2020-10-18T00:00:00+00:00
In Rust, the impl</code> keyword doesn’t have an associated visibility; there’s no such thing as pub impl</code>. However, that isn’t to say that implementations don’t have visibility—they do! Enter: RFC2145 - Type Privacy</strong></a>.</p>


Private Methods on a Public Trait
2020-10-18T00:00:00+00:00
In Rust, the methods of a trait inherit the visibility of the trait itself:</p>
pub trait</span> Foo</span><</span>Arg</span>> {</span></span>
</span>
    pub</span>(</span>self</span>)</span> fn</span> foo</span>(</span>&</span>self</span>, arg</span>:</span> Arg</span>);</span></span>
</span>
    /* other public methods */</span></span>
</span>
}</span></span></code></pre>error[E0449]: unnecessary visibility qualifier</span></span>
 --> src/lib.rs:7:3</span></span>
  |</span></span>
7 |   pub(self) fn foo(&self, arg: Arg);</span></span>
  |   ^^^^^^^^^</span></span></code></pre>
At minimum, we should hide this method from our documentation:</p>
pub trait</span> Foo</span><</span>Arg</span>> {</span></span>
</span>
    #[doc(hidden)]</span></span>
    fn</span> foo</span>(</span>&</span>self</span>, arg</span>:</span> Arg</span>);</span></span>
</span>
    /* other public methods */</span></span>
</span>
}</span></span></code></pre>
…but this doesn’t actually</em> prevent outsiders from calling our method! Fortunately, there are at least three other patterns #[doc(hidden)]</code> can be combined with to make foo</code> externally unusable.</strong></p>


Taming nalgebra's Rustdoc
2020-09-10T00:00:00+00:00
Nalgebra</a> is a powerhouse of functionality, but its documentation can be overwhelming—the documentation for Matrix</code></a> lists over 600</em> methods. Your documentation endeavors might not be quite</em> so overwhelming, but you still could benefit from these three tricks</strong> nalgebra uses to improve its docs.</p>


Fixing include_bytes!
2020-08-26T00:00:00+00:00
Rust’s include_bytes!</code> macro</a> lets you statically include the contents of a file into your executable’s binary. The builtin is a quick-and-dirty solution for packaging data with your executable, and perhaps even helping the compiler optimize your code! Unfortunately, it’s difficult to use correctly.</strong></p>


Javascript Generators, Meet XPath
2020-08-22T00:00:00+00:00
Using Generators to Modernize a Geriatric Javascript API for $CURRENT_YEAR</code></p>