There's a lot more unsafe code in Rust crates than there should be. That's a fixable problem. Some stuff from the early days predates the optimizer getting smart enough that unsafe code isn't needed. I wrote on this a few days ago in a Rust topic.
Re:Getting Past C
by Manishearth on Tuesday January 03, 2017 @09:02PM
(#13315082)
While I now mostly agree with you that there is more unsafe code than there should be, I still maintain that the frequency of unsafe in a deptree is usually still small enough to be practically auditable, ignoring FFI. It could/should be much less, but it's not too bad. I've done such audits a few times and it's not been too hard and taken very little time.
Auditing FFI is a whole other challenge, however :(
> I still maintain that the frequency of unsafe in a deptree is usually still small enough to be practically auditable
Not in binary libraries, hence why it is important to have a culture to only use unsafe if it really must be used.
Re:Getting Past C
by Manishearth on Wednesday January 04, 2017 @03:24PM
(#13321735)
Well, yeah, but you don't really download Rust binary libraries yet :)
You do have C libraries which you access through FFI. This is inevitably unsafe. We should be auditing more there. Though IMO it's still manageable, for most crates.
Re:Getting Past C
by staticassertion on Tuesday January 03, 2017 @09:51PM
(#13315289)
Hmmmm. Note to self - actually try to audit a reasonably sized project's unsafe code to see how reasonable it is.
Re:Getting Past C
by steveklabnik on Tuesday January 03, 2017 @06:49PM
(#13314419)
That's why I said "safe code," I mean, not using any unsafe.
The issue you're talking about is related, but different.
Right, I was just trying to put a finer point on your use of "using any unsafe" here. It sounds like you mean "using" in the lexical sense (writing the token "unsafe" in your code), but you mean it in the dynamic sense (having an unsafe block in your control flow graph.)
Re:Getting Past C
by steveklabnik on Tuesday January 03, 2017 @08:39PM
(#13314991)
That's a good distinction to draw, thanks.
AFAIK, cargo doesn't have any feature to point out when a crate contains unsafe code—so you pretty much need to grep the source of every crate you consume for "unsafe".