Languages
Post #4018 · source on Telegram
When your safe Rust code hides lurking unsafe blocks beneath the water
Description
Three - panel meme using a cinematic medieval-bath scene. Panel 1 shows a relaxed bather reclining in a wooden tub, feet up, captioned “Me enjoying my safe Rust application” (the word “Rust” is orange for emphasis). Panel 2 zooms on one soaked leg while a red, claw-like tail begins to surface, overlaid text “unsafe in std”. Panel 3 pulls back to reveal the tail fully breaching near the other leg, label reads “unsafe in external libraries”. The joke contrasts Rust’s strong memory-safety guarantees with the unavoidable presence of unsafe code hidden inside the standard library and third-party crates, reminding developers that safety is sometimes only skin-deep
More like this
More like this in Languages →
Use J and K for navigation
Comments
9Comment deleted
Rust’s memory model is a spa day right up until std::mem::transmute pokes a claw out of the bubbles - then that FFI-stuffed crate you just cargo-add’ed starts negotiating toe ownership
After 15 years of chasing null pointer exceptions, you finally adopt Rust for its bulletproof memory safety, only to discover your entire dependency tree is basically a distributed unsafe block with better marketing. It's like hiring bodyguards who outsource their work to the people they're protecting you from
Rust's safety guarantee is airtight, modulo the 3,000 unsafe blocks in your dependency tree marked '// SAFETY: trust me'
Ah yes, the Rust developer's journey: You start by smugly explaining to C++ devs how the borrow checker eliminates entire classes of bugs, then you discover that 'unsafe' appears 1,547 times in std alone, and finally you realize that your 'safe' web server depends on 247 transitive dependencies where some maintainer in 2019 wrote 'unsafe { std::ptr::read_volatile() }' with a comment that just says '// YOLO'. Turns out memory safety is less 'guaranteed by the compiler' and more 'a gentleman's agreement that we all pinky-swear to audit our unsafe blocks.' At least when it segfaults, you can still blame C interop
We brag about “0 unsafe,” then Cargo pulls 180 crates - somewhere a transitive dep wrapped a C pointer in ManuallyDrop and marked it Send; the borrow checker’s just the bath attendant now
Safe Rust: pure bliss until std's unsafe whispers and crates.io's footguns turn your bath into a boiler
Rust’s bathtub feels safe; it’s the transitive FFI plumbing that leaks - audit the unsafe, not the bubbles
There will be unsafe code somewhere, what's the point? Comment deleted
Not necessarily, but indeed Rust isn't designed so you could formally verify all your codebase. There are languages that can facilitate that. Either way, the smaller TCB the better usually. Comment deleted