We assumed Rust would be lower productivity than a language like Java, but that turned out to be an illusion. There was definitely a learning curve, but once the team was ramped up, they moved just as fast as they ever had.
Invoking undefined behaviour turns a tower of abstractions into a matryoshka doll of landmines.
-- Something I just came up with a few minutes ago in an e-mail to sum up an explanation of how, because a call to *_unchecked is probably going to call *_unchecked methods on whatever types are being wrapped, you have to understand every layer of abstraction to understand why breaking an invariant may invoke undefined behaviour.
Our experience is that no matter how many safeguards you put on code, there’s no cure-all that prevents bad programming. Of course, to take the contrary argument, seat belts don’t stop all traffic fatalities, but you could just choose not to have accidents. So we do have seat belts. If Rust can prevent some mistakes or malicious intent, maybe it’s worth it even if it isn’t perfect.
You might be asking: why did you rewrite [...] in Rust? And yeah, I don’t really have a good reason. It’s a hobby project. Like gardening, but with more segfaults.
C has to deal with the lifetimes of pointers too. The fact that the C compiler doesn't help you find problems doesn't make the underlying problem go away
In addition to rewriting the tools in Rust, a safer language, some little-used features of sudo were not implemented in order to reduce vulnerability surface area. This turned out to be meaningful in July of 2025 when two vulnerabilities (..) were discovered in sudo features not implemented in sudo-rs. In response to one of those, sudo has deprecated and will remove the feature hosting the vulnerability.
– Josh Aas on the prossimo blog
I like the quote because it shows that a) Rust doesn’t solve every problem (though it does solve a few), and b) it can be a very good idea not to implement all features.
I clone() everything now. The Borrow Checker permits this small rebellion, this inefficiency. It knows I suffer more knowing my code is not idiomatic. Every .clone() is a confession of my failure. Every Arc<Mutex> a monument to my inadequacy.
Many programmers dream of working on a farm or living in the woods, but when I retire, I’ll just be coding Java in Intellij all day, because that was good and nothing else is really there.
Bugs like this are the worst! It's almost impossible to catch them in development, because there is never enough load on the system to force the scheduler to move the execution to another thread. So, you end up with one of these "impossible to reproduce, fails sometimes, but never for you" bugs.
It's mind-blowingly cool that the Rust compiler can detect something like this. And that seemingly unrelated parts of the language, like mutexes, lifetimes and async operations form such a coherent system.
Rust just helps people of varying skill levels stay productive, without having to prove out correctness of the lower level primitives for each and every change.
But in general, I'd guess just different design decisions. As for how this might be related to Rust - I'm certain that were Wild ported from Rust to C or C++, that it would perform very similarly. However, code patterns that are fine in Rust due to the borrow checker, would be footguns in languages like C or C++, so maintaining that code could be tricky. Certainly when I've coded in C++ in the past, I've found myself coding more defensively, even at a small performance cost, whereas with Rust, I'm able to be a lot bolder because I know the compiler has got my back.