You won’t appreciate Rust unless you spend few weeks building something in it. The initial steep learning curve could be frustrating or challenging depending on how you see it, but once past that it’s hard not to love it. It’s a toddler with superpowers after all
I recently graduated with my Ph.D., after having worked on 5 different versions of my simulator, written in 4 different languages. The last version, written in pure, safe rust, worked correctly in part because of rust's strong guarantees about what 'safety' means, which I was able to leverage to turn what would normally be runtime errors into compile time errors. That let me catch errors that would normally be days or weeks of debugging into relatively simple corrections. [...] So, once again, thank you to everyone!
As the tradeoffs in software engineering change over time, so does the ideal solution. Some 40 years ago when the first C standards were written down, by people no less competent than those that work on Rust today, the design of the language and the list of behaviours not defined likely made much more sense in context of back then than they do right now. It is not all that unlikely that some years down the line the choices made by Rust won't make all that much of sense as they do today, too.
If manually managing memory is like wielding a gun, the borrow checker is an automatic safety that prevents you from pulling the trigger when you're roughly pointing it at yourself. But it's coarse-grained and errs on the side of caution; it simulates your foot as as the rectangular box that would contain it, not as a detailed 3D mesh. If you really think you can aim it between your toes and avoid hitting yourself (for example, "the value returned by this function must remain alive for no more than 15 successive invocations of this function"), unsafe will let you try, but the borrow checker's built-in rules isn't granular enough to help you, though it will still stop you if you accidentally put your hand in front without declaring it.
TBH I find "coarse-grained" a bit of a stretch. Without further context, the quote sounds as if the borrow checker was usually not really useful and had to be worked around, except for the most trivial cases. Whereas in reality, it's the exact opposite – needing to unsafe one's way around a borrow checker usability "bug" is – and should be – extremely rare.
Maybe a better metaphor would be that the borrow checker won't let you fire at targets smaller than the cone of uncertainty without a backstop to catch the bullet.
For system-level folks, Rust is one of the most exciting security developments of the past few decades. It elegantly solves problems which smart people were saying could not be solved.
Fuchsia has a lot of code, and we made sure that much of it (millions of LoC) was in Rust.
Our kernel, Zircon, is not in Rust. Not yet anyway.
Go loses its memory safety guarantees if you write concurrent software. Rust loses its memory safety guarantees if you use non-trivial data structures. C++ loses its memory safety guarantees if you use pointers
I don't agree. We can use Rc<RefCell<T>>/Weak<RefCell<T>> and then indeed lose compile-time memory safety, but we usually instead use unsafe code and encapsulate it in crates. There are tons of crates for complex data structures, and they have very strong memory safety guaranteed.
C++ doesn't have any memory safety guarantees at all
There's at least an explanation needed here. This is simply not true as-is in the absence of unsafe, and many non-trivial data structures can in fact be implemented without unsafe.