206
DARPA suggests turning old C code automatically into Rust – using AI, of course (www.theregister.com)
submitted 3 months ago by lemmee_in@lemm.ee to c/programming@programming.dev
61 comments fedilink hide all child comments

To accelerate the transition to memory safe programming languages, the US Defense Advanced Research Projects Agency (DARPA) is driving the development of TRACTOR, a programmatic code conversion vehicle.

The term stands for TRanslating All C TO Rust. It's a DARPA project that aims to develop machine-learning tools that can automate the conversion of legacy C code into Rust.

The reason to do so is memory safety. Memory safety bugs, such buffer overflows, account for the majority of major vulnerabilities in large codebases. And DARPA's hope is that AI models can help with the programming language translation, in order to make software more secure.

"You can go to any of the LLM websites, start chatting with one of the AI chatbots, and all you need to say is 'here's some C code, please translate it to safe idiomatic Rust code,' cut, paste, and something comes out, and it's often very good, but not always," said Dan Wallach, DARPA program manager for TRACTOR, in a statement.

you are viewing a single comment's thread
view the rest of the comments
[-] MajorHavoc@programming.dev 105 points 3 months ago* (last edited 3 months ago)

"You can go to any of the LLM websites, start chatting with one of the AI chatbots, and all you need to say is 'here's some C code, please translate it to safe idiomatic Rust code,' cut, paste, and something comes out, and it's often very good, but not always," said Dan Wallach, DARPA program manager for TRACTOR, in a statement.

"This parlor trick impressed me. I'm sure it can scale to solve difficult real world problems."

It's a promising approach worth trying, but I won't be holding my breath.

If DARPA really wanted safer languages, they could be pushing test coverage, not blindly converting stable well tested C code into untested Rust code.

This, like most AI speculation, reeks of looking for shortcuts instead of doing the boring job at hand.

[-] kbin_space_program@kbin.run 69 points 3 months ago

It reeks of a consultant who sold upper management via a gated demo.

[-] cucumber_sandwich@lemmy.world 12 points 3 months ago

You would also port the tests, right?

[-] MajorHavoc@programming.dev 7 points 3 months ago* (last edited 3 months ago)

You would also port the tests, right?

Right... If they exist.

But that bit shouldn't be left to a hallucination prone AI.

[-] leds@feddit.dk 6 points 3 months ago* (last edited 3 months ago)

You have tests?

Edit: guess could always use AI to auto generate tests /s

[-] cucumber_sandwich@lemmy.world 3 points 3 months ago

I mean the parent comment mentioned tests...

[-] thingsiplay@beehaw.org 11 points 3 months ago

Also:

As to the possibility of automatic code conversion, Morales said, "It's definitely a DARPA-hard problem." The number of edge cases that come up when trying to formulate rules for converting statements in different languages is daunting, he said.

[-] ByteOnBikes@slrpnk.net 10 points 3 months ago

I'm thinking they also want to future proof this.

The quantity of C devs are dying. It's a really difficult language to get competent with.

[-] MajorHavoc@programming.dev 3 points 3 months ago

That's a really valid point.

[-] ulterno@lemmy.kde.social 0 points 3 months ago

A really unfortunate one too.

[-] 0x0@programming.dev 6 points 3 months ago

If DARPA really wanted safer languages, they could be pushing test coverage,

Or Ada...

[-] FizzyOrange@programming.dev 2 points 3 months ago

Ada is not strictly safer. It's not memory safe for example, unless you never free. The advantage it has is mature support for formal verification. But there's literally no way you're going to be able to automatically convert C to Ada + formal properties.

In any case Rust has about a gazillion in-progress attempts at adding various kinds of formal verification support. Kani, Prusti, Cruesot, Verus, etc. etc. It probably won't be long before it's better than Ada.

Also if your code is Ada then you only have access to the tiny Ada ecosystem, which is probably fine in some domains (e.g. embedded) but not in general.

[-] sudo42@lemmy.world 1 points 3 months ago

A: "We really need this super-important and highly-technical job done."
B: "We could just hire a bunch of highly-technical people to do it."
A: "No, we would have to hire people and that would cost us millions."
B: "We could spend billions on untested technology and hope for the best."
A: "Excellent work B! Charge the government $100M for our excellent idea."

this post was submitted on 04 Aug 2024
206 points (96.4% liked)

Programming

17342 readers
327 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 1 year ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
MaungaHikoi@lemmy.nz