getrandom VS zig

The crypto source in Go is great, no complaints there. Lints like gosec even recommend using it when generating crypto entropy. Go did a good job here, and I expect Rust will do the same sometime after getrandom reaches 1.0 so the API questions are settled, plus whatever makes sense for the future-proofing the standard library needs.

I would wait for the getrandom crate to reach 1.0, which will answer many of the questions around what an API like this can look like, and then maybe the standard library discussion will be on firmer footing because at least we'll know what API we want to immortalize. Rushing that now just to save people importing a small crate does not seem to be the way to go.

I'd caution against using /dev/random directly, and instead recommend using getrandom. It's effectively the same thing on Haiku and Redox, but is cross-platform and will upgrade to better sources on various platforms as available (such as using the getrandom() call on Linux and Android, or getentropy() on macOs, if avaialable).

getrandom

It's a default, but overwritable behavior, see the #[path] attribute. You still have to create N files for each supported platform, but at the top level you will see only one module. On of the crates which uses this approach in practice is getrandom.

IIUC the main problem which prevents from moving HashMap & co to alloc is lack of API to get system entropy which is required for DOS protection. Ideally we would have a #[global_allocator]-like functionality for retrieving system entropy. Relevant issue: https://github.com/rust-random/getrandom/issues/21

There is an issue proposing this approach: https://github.com/ziglang/zig/issues/4284

https://github.com/ziglang/zig/issues/224

e.g.:

> > When debugging/prototyping, it's useful to comment out a line without having to refactor, e.g.

When writing code in a scripting language, sometimes you need that extra bit of performance (or maybe an async feature from Zig).

NodeJS is by no means a slow runtime, it wouldn’t be so popular if it was. But compared to Bun, it’s slow. Bun was built from the ground up with speed in mind, using both JavascriptCore and Zig. The Bun team spent an enormous amount of time and energy trying to make Bun fast, including lots of profiling, benchmarking, and optimizations.

ntdll.dll!RtlUserThreadStart()

There are valid reasons to use APIs from NTDLL. Where I disagree with zig#1840 is the idea that it is always better to use NTDLL versions of API. Every other software ecosystem uses the standard Win32 APIs and diverging from that without a good reason seems like a good way to have unexpected behavior. One concrete example is most users and programmers expect Windows to redirect some file system paths when running on WOW64. But this is implemented in Kernel32, not ntdll.

https://github.com/ziglang/zig/issues/11894

Zig also has an IRC channel on libera (#zig) that is moderated by Andrew Kelley.[1]

[1] https://github.com/ziglang/zig/wiki/Community