[rurban]

Yes, Rust is a good systems programming language. Just not safe. Safer than most others, yes. Good enough, yes.

But there exist safe systems programming languages. Safe systems were done in these languages. Just nobody cared, so they died or have no market share.

[adastra22]

Which ones?

[rurban]

Do I have to do osdev language research for you now? I'm certainly missing some, but out of my head: Mesa/Cedar, Concurrent Pascal, Smalltalk, Lisp, ADA, C#/M# for Midori/Singularity, Oberon, ...

[adastra22]

All of those have unsafe-like escape hatches, with the notable and singular exception of Concurrent Pascal. In each of the others you can access their own version of `unsafe` as an escape hatch

Mesa/Cedar: LOOPHOLE inside an UNSAFE module

Smalltalk 80: You can access the built-in VM instructions directly using the <primitive: N> syntax. E.g. basicAt:put: at <primitive: 61> avoids bounds checks and type checks.

Common Lisp: (safety 0)

Ada: Unchecked_Conversion, Unchecked_Deallocation

C#/M#: unsafe class MyClass<T> where T : unmanaged

Oberon: the SYSTEM module

Rust isn't any different, and unsafe exists in Rust for the same reason it exists in all these other languages. You use it to create new constructs the language authors didn't foresee. Concurrent Pascal is the singular exception: You can't do anything the language doesn't provide out of the box. Need something Brinch Hansen didn't think of? Sucks to be you.

If you want the rusty version of Concurrent Pascal though, you can have that. Put #![forbid(unsafe_code)] in your crate's lib.rs, or your Cargo.toml. Done.

[OneWingedShark]

While Ada does have `Unchecked_Deallocation` and `Unchecked_Conversion`, Ada out-of-the-box provides safety roughly on-par with the high-integrity C++ style-guide. For provable safety, the SPARK subset/provers are used.

There's a lot you can do in Ada without resorting to them, and even with using them it can be perfectly fine, such as (eg) "view conversion" of a register or memory-mapped location -- remember that a lot of APIs (and ABIs) have been kneecapped by catering to C's inabilities, so even if the idea is directly expressible in some higher level language it will be exposed at the lower level.

[adastra22]

And Rust out of the box is safe by default, and you never have to resort to using unsafe {} blocks in normal usage.

I'm not trying to fight some religious war here. You want to use Ada? Great! But don't pretend that the existence of the unsafe keyword somehow makes Rust unacceptably impure. The same escape hatches exist in every other "safe" language outside of the one toy example whose entire niche purpose was to avoid unsafe, and which no one uses now because the language is ossified and non-extensible.

[rurban]

Sucks to need to add unsafe new constructs the language authors didn't foresee, and still call it safe. Should have been forseen.