W^X/NX bits and other technologies don't totally obviate the issue, as ROP gadgets can be used to defeat it. And so on, there's a whole domain of computer science dedicated to that arms race and no evidence that it's stopping any time soon.
On the other hand, a Rust program without unsafe should simply never execute code outside of its defined control flow, it's not possible to hijack any control flow on the stack or heap, and so a running program under arbitrary user input can only ever explore execution paths that exist in the absence of memory unsafety. No ROP gadgets or heap/stack smashing, no overflows leading to overwriting a function definition in memory, no overwriting the parameters of a function to cause impossible branches to be taken, and so on.
I agree, for many programs memory safety matters. But there are a large chunk of programs where it doesnt matter/is not worth the effort.
While true, I think the vast majority of programs do do one of these two things (and increasingly, both), whereas the majority of programmers seem to think that what they work on "isn't a security issue".
It's this disconnect that is giving us the Internet of Crap. Your phone apps, your fridge, your video games, your text editor -- every program I interact with every day -- it's all a security issue
The kernel doesn't automatically defend against RCE.
by:
> That's what the kernel is there for.
I meant, you should still be able to easily restart your program and continue using it. It wont crash your computer.
RCE is only a problem for computers that are connected to the internet and/or take user provided input.
The classic program safety vs programmer time tradeoff.