> A bit surprised that it’s written in rust, rather than Go. I suppose rust can take advantage of more low level apis, plus no overhead of garbage collection.

It’s security-focused technology. Rust has huge advantages over Go in this area.

> Rust has huge advantages over Go in this area.

Could you name some advantages? I would agree Rust has huge advantages compared to C/C++, and Rust also has a much bigger presence in the "security space". But I would say that's more because of Rust's lack of GC, smaller footprint which works in embedded systems etc.

I guess you could say that Rust's type system being more expressive might eliminate certain classes of bugs, which have security implications. But "huge advantages"?

(Honestly I'm not flame baiting, I'm genuinely curious if my worldview is wrong)

> But "huge advantages"?

They don't call null/nil the billion dollar mistake for nothing.

I think lack of union/sum types, i.e. lack of compiler exhaustivity checks on cases is pretty relevant here. For security applications the goal is maximum stringency w.r.t. correctness so I think “huge advantage “ isn’t an exaggeration regarding sum types. It’s not like “have you checked all cases” is an unimportant question when trying to prove correctness.

does it really? aside from a handful of crates and the default std hashmap i being slow but cryptographically sound: I would not have assumed so.

Go usage inside Google is actually quite low, people talk a lot about Go being a google project but in reality its a project made by some people who work at Google.

When I last checked it was a bronze supported language (with C++, Python and Java being Gold).

Python has first class support at Google? Didn't they just fire their entire Python team?

Roughly, yes, but they didn’t stop doing the work. It was moved to another set of people.

What advantages are those?

Rust's compiler can prevent data races, for example. (It forbids mutation in the presence of aliasing, which is the root of it.)

should be mentioned that Go has optional flags already built in to the compiler for detection of data races.

the race detector ( -race ) only detects races that actually occur. If they don't happen, then it doesn't detect them.

should we also mention that C has optional tooling for memory safety?

I think using Go is not a popular decision in the Android ecosystem, especially for those system programming stuffs. It's very likely that the project needs tight client side integration, so they probably wanted to use a language which has a wider support especially in the case of possible iOS support.

The hardware features used for this are Intel and AMD CPU extensions: they're writing a microvm to run inside special "enclave" virtual machines. Go is a fine language but it's not really intended for this sort of work. Rust is a natural fit for this work: you can write low level drivers and also ensure a number of safety properties.