<story><title>Blue Team Rust: What Is “Memory Safety”, Really?</title><url>https://tiemoko.com/blog/blue-team-rust/</url></story><parent_chain><item><author>burntsushi</author><text>Calling an unsafe function can only be done inside an unsafe block.</text></item><item><author>Animats</author><text>&lt;i&gt;Today we can guarantee (barring compiler errors) memory safety in safe rust, but not unsafe rust.&lt;/i&gt;&lt;p&gt;Not quite. An unsafe function can export its lack of safety to other code. If an unsafe function can be called with parameters which make it violate memory safety, it opens a hole in memory safety.</text></item><item><author>staticassertion</author><text>One thing I&amp;#x27;ve realized with Rust is that its guarantees are a moving target. Today we can guarantee (barring compiler errors) memory safety in safe rust, but not unsafe rust.&lt;p&gt;But that story is improving. For one thing, we have people working to build safe abstractions for more unsafe use cases, at zero cost. We also have people improving fuzzing, and in theory safe rust code grows at a much faster rate than unsafe rust code, so fuzzing is far more tractable. We have people working on proving more about rust code, even when unsafe is around.&lt;p&gt;I&amp;#x27;m quite excited to see how far Rust is able to go, I don&amp;#x27;t believe the state today is the end at all.</text></item></parent_chain><comment><author>the_duke</author><text>I assume OP s point is that unsoundness or UB in an unsafe block is not contained in that block, but can taint safe code anywhere in the program. Which is true.</text></comment>
<story><title>Blue Team Rust: What Is “Memory Safety”, Really?</title><url>https://tiemoko.com/blog/blue-team-rust/</url></story><parent_chain><item><author>burntsushi</author><text>Calling an unsafe function can only be done inside an unsafe block.</text></item><item><author>Animats</author><text>&lt;i&gt;Today we can guarantee (barring compiler errors) memory safety in safe rust, but not unsafe rust.&lt;/i&gt;&lt;p&gt;Not quite. An unsafe function can export its lack of safety to other code. If an unsafe function can be called with parameters which make it violate memory safety, it opens a hole in memory safety.</text></item><item><author>staticassertion</author><text>One thing I&amp;#x27;ve realized with Rust is that its guarantees are a moving target. Today we can guarantee (barring compiler errors) memory safety in safe rust, but not unsafe rust.&lt;p&gt;But that story is improving. For one thing, we have people working to build safe abstractions for more unsafe use cases, at zero cost. We also have people improving fuzzing, and in theory safe rust code grows at a much faster rate than unsafe rust code, so fuzzing is far more tractable. We have people working on proving more about rust code, even when unsafe is around.&lt;p&gt;I&amp;#x27;m quite excited to see how far Rust is able to go, I don&amp;#x27;t believe the state today is the end at all.</text></item></parent_chain><comment><author>saagarjha</author><text>I’m unsure what you’re responding to. As I understood it, the comment took issue with saying that you can make guarantees about safe Rust but not unsafe Rust because unsafe Rust is not verified in that way and opens the door to violating guarantees in your “safe” code if your bugs leak out.</text></comment>