← Back to context

Comment by nostrademons

4 hours ago

Why C instead of Rust if you're using AI anyway?

C introduces the possibility of memory-safety issues, which are deadly in server software that's exposed to the Internet. And AI, from what I've seen, is not all that great at writing software with zero memory bugs.

Rust closes the memory safety holes, at the cost of making the programmer think through ownership and architecture much more carefully. Those are exactly the skills that AI is good at. So if you want something fast and are writing it with AI anyway, why not have the AI generate Rust code?

11 comments

nostrademons

Reply
joshheitzman  3 hours ago

Because the memory safety Rust offers isn't worth the supply chain risks: https://safeguard.sh/resources/blog/rust-supply-chain-securi...

  • zanecodes  3 hours ago

    A problem that C solves by simply not having a supply chain! You can vendor dependencies in Rust just as easily as you can in C; far easier in fact thanks to `cargo vendor`. Cargo won't review them for vulnerabilities though, you'll still have to do that yourself.

    • 1718627440  3 hours ago

      It does, the package systems of C evolved alongside the OS, so they are now the OS package managers and also cope with all other language mangers.

  • nostrademons  3 hours ago

    Don't use packages you didn't vibecode and audit yourself then. That's the situation C puts you in anyway.

    • joshheitzman  2 hours ago

      The Rust ecosystem isn't structured for the high friction dependency model the C has. Its structured around nearly frictionless dependencies so its no surprise that dependency trees are very large and frequently changing.

      The typical C project has far fewer dependencies than the typical Rust project. Those dependencies are usually individually larger and either maintained by OS maintainers or there is a copy of the code that is built for the project and is readily available for audit. Those copies can't change without direct action.

      Its less trouble to setup static analysis, address sanitizer, and similar tools for a C project than it would be to manage local copies of thousands of dependencies for a Rust project.

      2 replies →