Comment by fivelessminutes

There has actually been a few crashes in the core TCP/IP stack of both Linux and Windows in the last 5 years, though I'm not sure any of them were due to memory safety (most were logic bugs as far as I can tell). That said, rust's approach to error handling could help avoid crashes here as well.

However, we have seen *many* memory-safety crashes in the drivers to talk to network interfaces. Those really are full of security vulnerabilities. The most prominent recent one was broadcom's wifi driver having heap buffer overflows allowing remote code execution by anyone within wifi range in 2019[0].

[0]: https://www.bleepingcomputer.com/news/security/broadcom-wifi...

The fact is that it is overwhelmingly more difficult to write and guarantee that your C code is "safe" to the same extent that a naively-written Rust program which accomplishes the same thing would be, especially as your software's complexity increases.

Is it possible to write C code that has the safety properties of Rust code which provides the same functionality? Absolutely, in theory. But will you be able to accomplish this and then guarantee this safety and have the confidence that future code changes won't break those guarantees? That becomes exceedingly more difficult to do, nevermind the extra time and effort it would take. In most cases this would be prohibitively expensive, and you'd just get on with life hoping for the best and mitigating what you can.

In my view, one of the killer features of Rust is its ability to be easily ABI-compatible with C as needed, which I see as a pragmatic feature of Rust that acknowledges the messy software reality of our world and the fact that C (or any other language) isn't just going to be "replaced" by rewriting stuff everywhere, neither anytime soon nor probably ever in totality. This lets us more readily combine the great capabilities of Rust with the enormous volumes of useful code that already exist today without resorting to dogmatic approaches of always thinking we need to rewrite the latter. The "rewrite everything in Rust" idea is fun in an academic kind of way, but in the real world economics will prevent that from happening everywhere, in a similar way that economics usually prevents you from validating and providing certain safety guarantees about your C code.

The TCP/IP stacks of the few popular OSes is not full of security issues, but that took a lot of effort that a small team can't do. Also, it's a matter of updating: after reviewing the CVE database, would you be comfortable running a 5 year old kernel without updates?