[alphaalpha101]

Not necessarily. There is no actual reason that you couldn't be required to prove to the compiler that your code is safe.

That proof might be parameterised by a proof that some external FFI function was safe, which you might not be able to actually prove and have to assume, but then you would have your assumptions well-documented.

As it is, you have to justify the safety of your unsafe blocks to other programmers using comments, which kind of sucks.

Still better than every other fast language in this area though so I can't complain much.