Can we trust libc?

No.

In order to make any calls into libc one has to use FFI. Which necessarily means wrapping those calls in "unsafe". At which point all (many/most) of Rust's safety guarantees are switched off.

Philosophically I would say all kind of things come with safety guarantees. Those guarantees are only valid in some range of applicability of the product, as long as you follow the manufacturers instructions, and so on.

Your nice, safe, Volvo might come with ant-lock brakes, air bags, and all kind of features to increase your driving safety. But drive into a war zone full of mines and missiles and all bets for safety are off.

Rust is that Volvo, libc and and all else is the war zone!

(God I hate car analogies).

15 Likes