Comment by afdbcreid

Yes you need to vet touching safe code. Which is why you keep things private, encapsulate them, and extract them into reusable crates.

The most important reason unsafe code is harder to write than C or C++ is that you must keep soundness, something none of these languages have. But yes the different rules also play part (although: do you know a single C or C++ codebase that does not violate TBAA? Some just disable it in the compiler, making them non-standard, while some just leave it potentially exploitable).

But the most important answer is the empirical evidence like I brought above. We have empirical evidence C and C++ codebases cannot be secure. We have empirical evidence Rust codebases can, even with unsafe code. Therefore, Rust is safer, period.

> Do Rust libraries, including std, historically have had UB bugs?

Did C or C++ libraries, historically, have UB bugs? Sorry, that just amplifies the strawman.

> Can Miri catch everything?

Miri is a dynamic analyzer, aka. a sanitizer. It will catch anything you test. It's like in C and C++, except you only need it for unsafe code.

> Are all the rules of unsafe, pinning, etc. fully specified and easy to learn and reason about?

Fully specified? People are working on it (are C's and C++'s UB rules fully specified? I'll save you the answer: no. Yes there is a standard and it's woefully incomplete).

Easy to learn and reason about? Probably not, which is why not everyone should be writing unsafe code.

Possible to learn and reason about? Absolutely yes. Especially with existing and emerging dynamic and static analyzers.