> Microsoft: 70 percent of OUR security bugs are memory safety issues

Fixed the title. This is not an analysis about general software errors.

Every project with millions of lines of C or C++ is going to be around the same, Firefox is over 50% as well.

Linux is much worse currently, hence the Kernel Self Preservation project being pushed by Google.

This paper's an interesting read, about writing an OS in Go:

The benefits and costs of writing a POSIX kernel in a high-level language

https://www.usenix.org/conference/osdi18/presentation/cutler

Not that Cutler, phew.

He would never write a (mainly) Posix kernel ;)

I knew this comment was coming :)))

It IS why Mozilla sponsored the language. The early "why Rust" presentations had a stat that (paraphrasing) 50% of Mozilla security bugs would have been prevented by the borrow checker.

Yeah. I looked at the comments looking specifically for this comment. I was not disappointing.

or some language with the runtime. for example, c#?

Microsoft did just that, by extending C#: https://en.wikipedia.org/wiki/Singularity_(operating_system)

Maybe you can do a proof of concept by writing a mini-Linux using Rust.

Right because Rust will prevent all the issues of Unsafe usage that an OS uses all the time ...

Say the same thing about seatbelts in a car. If you don’t plan to have accidents, why do you need seatbelts?

Car accidents, like mistakes in programming are a risk that has a likelyhood that is non-zero. A seatbelt might be a little bit annoying when things go well, but much less so when they don’t. Rust is there to stop you in most cases when you try to accidentally shot yourself into the leg, unless you deliberately without knowing what you are doing while yelling “hold my beer” (unsafe). And contrary to popular belief even in unsafe blocks many of Rust’s safety guarantees hold, just not all

If the net benefit of a ownership concept like Rust has it is high enough, this ahouls be an easy choice for rational actors to take. The odds are on Rust’s side here, because humans make mistakes and if Rust manages to allow productivity despite stopping certain classes of these mistakes, there will be a net benefit.

Just like with the seatbelt, there will be always those that don’t wear one for their very subjective reasons (e.g. because of edge cases where a seatbelt could trap you in a burning car, or because it is not cool, or because they hate the feeling and think accidents only happen to people who can’t drive).

I write Rust for a year now, and I constantly see bugs far better programmers made in say C++ where Rust just wouldn’t allow you to not handle it. E.g. Crashing your software by writing to a file that is locked by another process. In Rust this would mean the deliberate act of ignoring a Result, unwrapping it and moving on. You can ignore it, and Rust will crash, but you know exactly where you took that risk.

Things like these remove a lot of cognitive load from the programmer which can be put into more pressing topics

There’s a similar distinction between most C++ development and dropping to low-level placement new, mallocs/frees, handwritten assembly or heavy use of intrinsics. You rarely need the latter, and, once wrapped, when used by the former is quite safe. The difference is that Rust was designed with this in mind.

I like Rust; I’ve done some coding challenges in it. It won’t replace C++ for me for quite some time, but it’s about time there was a safe, powerful language that’s truly a worthy contender.

You're being sarcastic, but I think you'll find the limited use of unsafe in Philipp Oppermann's series informative: https://os.phil-opp.com/

How many of those unsafe patterns could be written in safe code? (The answer: nearly all of them.)

So what if Rust doesn't prevent all conceivable memory safety issues anyone could possibly write? It's a huge improvement.