From: Ralf Jung Date: Wed, 22 Aug 2018 18:01:21 +0000 (+0200) Subject: tweak the slogan X-Git-Url: https://git.ralfj.de/web.git/commitdiff_plain/d9ec12b20e000a9e98cef90f0be0904a9874c700?ds=inline;hp=542866b9624f6d834a9d9560cff8bd459e5593f9 tweak the slogan --- diff --git a/ralf/_posts/2018-08-22-two-kinds-of-invariants.md b/ralf/_posts/2018-08-22-two-kinds-of-invariants.md index b403c70..a90dc47 100644 --- a/ralf/_posts/2018-08-22-two-kinds-of-invariants.md +++ b/ralf/_posts/2018-08-22-two-kinds-of-invariants.md @@ -180,7 +180,7 @@ My gut feeling is that it should not be (i.e., validity should require that `i32 I have talked about two kinds of invariants that come with every type, the safety invariant and the validity invariant. For unsafe code authors, the slogan summarizing this post is: -> *You must always be valid, but you must not always be safe.* +> *You must always be valid, but you must only be safe in safe code.* I think we have enough experience writing unsafe code at this point that we can reasonably discuss which validity invariants make sense and which do not -- and I think that it is high time that we do so, because many unsafe code authors are wondering about these exact things all the time.