DIP1028 - Rationale for accepting as is

[Arine]

On Sunday, 24 May 2020 at 03:28:25 UTC, Walter Bright wrote:
> I'd like to emphasize:
>
> 1. It is not possible for the compiler to check any 
> declarations where the implementation is not available. Not in 
> D, not in any language. Declaring a declaration safe does not 
> make it safe.

That's why Rust has gotten rid of declarations all together, 
except for C, which are implicitly marked unsafe, and they cannot 
be marked "safe" (there is no such feature).

> 2. If un-annotated declarations cause a compile time error, it 
> is highly likely the programmer will resort to "greenwashing" - 
> just slapping @safe on it. I've greenwashed code. Atila has. 
> Bruce Eckel has. We've all done it. Sometimes even for good 
> reasons.

Having extern(C) be @safe by default doesn't stop greenwashing. 
As others have pointed out, you are doing the greenwashing for 
the programmer. That's not better.

> 3. Un-annotated declarations are easily detectable in a code 
> review.

Declarations annotated with @trusted are even easier to detect. 
And arguably declarations that aren't annotated aren't that easy 
to detect.

> 4. Greenwashing is not easily detectable in a code review.
>
> 5. Greenwashing doesn't fix anything. The code is not safer. 
> It's an illusion, not a guarantee.
>
> 6. If someone cares to annotate declarations, it means he has 
> at least thought about it, because he doesn't need to. Hence 
> it's more likely to be correct than when greenwashed.
>
> 7. D should *not* make it worthwhile for people to greenwash 
> code.
>
> It is, in a not-at-all obvious way, safer for C declarations to 
> default to being safe.

This whole situation just makes it more obvious to me, you 
shouldn't be able to mark extern(C) declarations as @safe or 
@trusted at all. If that truly is your fear, it should just not 
be possible to mark them as @safe/@trusted.

8. D should make incorrect code *more* difficult, not easier. Or 
are you conveniently ignoring this ideology?

Code is going to break no matter what. That's the cost you are 
going to pay for making @safe default. You can't fix that. The 
difference is what the aftermath will look like.