> The issues with C are borne directly by the customers who are using C software. It’s not really a market failure of any kind.

While I agree that equating a programming language to a carcinogenic substance is inherently wrong, your argument is partially false too.

The cost is born by the costumers of the software, not the developers. In that sense, it's actually directly opposed to your point.

Isn’t that what I said? I don’t see any difference.

If you did then I dont understand the point you're making with the given example.

with the language you've got

  * the creators of C
  * the developers writing software (tool/library/whatever) with C
  * the users which use this software 

If the software has a security issue, the cost will have to be born by the users, not the developers.

That makes it (imo) directly opposed to your argument, as its technically the same as with the carcinogenic substance

  * the creators of the substance dont get cancer
  * the contractors using it to build the house dont get cancer
  * the people that live in the house get cancer

Asbestos is killing mostly the contractors instead of the users, which is breaks the analogy here. (That being said, any argument using the “market failure” concept is dubious from the beginning)

I see where your confusion stems from. In the case of asbestos, it is the contractors using it to build the house who tend to experience adverse health effects, and not always the people who live there. Asbestos is harmless when it's inert in the wall, paint, etc. The danger is when you start doing construction / renovations and the dust is free floating.

So OP's point is correct. The two situations are not exactly analogous.

Well the creators of the substance (manufacturers who used asbestos in their products) and the contractors that installed the products did in fact also get cancer.

You're both a little bit wrong, and both want to be right, so seem to be ignoring the negative aspects of both your arguments.

C does not have a direct proven link to causing death or catastrophic disease like asbestos does, but any bugs due to language "allowing" the dev to shoot themselves in the foot is largely born by the users - at least initially.

As others said - asbestos is really bad for asbestos miners, and pretty bad for installers. But it’s pretty much totally inert when installed - it doesn’t affect homeowners.

> equating a programming language to a carcinogenic substance is inherently wrong,

I work with C and it kills me a little more each day, just like cigarettes. Its a pretty fair comparison.

I don’t think the federal government should step in and regulate it, but why not some kind of professional or trade organization, like UL?

And really, I think your argument bolsters my case. Federal and state governments are freaking out about cybersecurity and protecting infrastructure and voting systems, so why shouldn’t they ban the use of software written in C in their acquisition process?

Such regulations already exists, see for instance https://en.wikipedia.org/wiki/MISRA_C. Similar rules could be created for Rust (I would assume that this would have to be some sort of 'sane subset' of Rust, which for instance would forbid dynamic memory allocation alltogether).

Or you could use https://en.m.wikipedia.org/wiki/SPARK_(programming_language) which is already a formal defined language and literally the thing discussed in the link right at the top.