The truth of the matter is, so long as you're dealing with non-deterministic system states or unsafe regions of code, you will always be prone to failing at runtime. Incorrect programmer assumptions, out of memory errors (which are becoming more common with memory-constrained containers), parsing implemented using a ok-or-panic idiom, attempting to read a file you have no permissions to access, having to read from volatile memory regions, cosmic rays flipping memory bits... all can cause even Rust programs to fail at runtime.

Runtime failure is a reality of every program, best to account for it.

> all can cause even Rust programs to fail at runtime

For sure, a safe Rust program can fail in a dozen different ways. My favorite is just creating an unsigned 0 and trying to subtract 1 from it -- in debug mode that'll panic and probably crash the whole program. But unless you touch the `unsafe` keyword, it should be impossible to fail in a way that causes undefined behavior. That's the big difference.

Edit: You're right, I missed the point :| :| :|

The whole article is about preventing undefined behavior WRT memory allocation and deallocation, so that's kind of beside the point.

True, but shouldn't we try to at least reduce this attack surface?

I would be radiant with joy and more if cosmic rays formed a significant part of my issues.