Rust (Programming Language)
Rust as an engineering choice — its ownership/borrow-checker model, unsafe escape hatch, and community governance — studied for how it changes data-structure design, incident cost, and low-level memory/performance engineering in production systems.
Also known as: Rust, Rust programming language, borrow checker, ownership and borrowing, unsafe Rust, Rust FFI, zero-cost abstractions, memory safety without GC, ownership topology
How authors use it
Oldest first (extraction date when no publication date is known).
| Author | Their term | Their meaning |
|---|---|---|
| Why Rust is different, with Alice Ryhl The Pragmatic Engineer (Gergely Orosz, host) · 2026 | borrow checker | Compile-time analysis ensuring that references (borrows) do not outlive their referent and that mutable and shared borrows do not overlap — one writer xor any number of readers, scoped per function. |
Documents (3)
- Cloudflare Cuts 100 TB of Memory from 1.1.1.1 DNS Cache Leela Kumili · 2026-09-23 Reader 🖥️
Cloudflare cut its DNS cache's per-entry memory footprint by 56% and freed ~100 TB of fleet-wide working-set memory, without sacrificing (and while improving) throughput and latency, by collapsing the in-memory representation of cache entries toward DNS wire format instead of a typed, allocation-heavy Rust structure. - Bun Rewrites 535K Lines of Zig into Rust in Four Months, Eliminates Numerous Memory Leaks Bruno Couriol · 2026-09-20 source ↗ Reader 🖥️
A single domain expert, directing dozens of parallel adversarial-review AI agents against a mechanical (behavior-preserving) porting process anchored to an extensive pre-existing test suite, rewrote a 535K-line production codebase into a memory-safer language in months instead of a year and shipped measurable bug and memory-leak reductions — but critics dispute whether passing that same test suite ever was, or could be, sufficient proof that a million lines of largely unreviewed AI-generated code are actually safe. - Why Rust is different, with Alice Ryhl The Pragmatic Engineer (Gergely Orosz, host) · 2026 Reader 🖥️
Rust earns its growing adoption not by adding features but by systematically engineering away whole classes of programmer mistakes — null, uninitialized memory, unhandled errors, stale documentation, memory-unsafety, non-exhaustive matches — through a type system, ownership/borrow checker, and a governance and tooling culture (RFCs, editions, Cargo, doc-tests) that treats reliability as a composite property rather than a single feature.
Propositions touching this concept (34)
By publication month, oldest first (extraction month when no publication date is known).
2025-10
- explicitHe switched his daily-driver harness from Claude Code to the Codex CLI mainly for larger usable context (~230k vs. ~156k tokens), slower token-fill rate, true message queuing, raw speed (Codex rewritten in Rust vs. multi-second freezes and gigabyte memory blowups in Claude Code), and tone (Codex pushes back and is more careful; Claude's sycophantic 'absolutely right' and false '100% production ready while tests fail' language affected his mental health) — an impressionistic comparison, not a formal benchmark.
2026
- explicitcorroboratedRust's distinctive value is the combination — memory safety, no GC, low-level usability, type system, exhaustive matching, explicit errors — rather than any single feature.
- explicitWhen Rust code compiles, it works — in a strong-enough sense to change how engineers approach refactoring (drive the compiler errors to zero and you have updated every call site).
- explicitMost small mistakes in C/C++ are not just bugs but security vulnerabilities; Rust eliminates that class entirely outside of `unsafe`.
- explicitdevelopedRust's hardest learning curve is data-structure design, not syntax — the borrow checker forces tree-or-DAG shapes and rejects naive cyclic graphs.
- explicitFighting the borrow checker is usually a signal to redesign the struct, not the function — i.e. the language pushes problems back into design.
- explicitRust governs without a benevolent dictator — language change requires team sign-off via RFC + Final Comment Period, with concerns acting as veto-pauses.
- explicitEditions let Rust make breaking syntactic/semantic changes without breaking the ecosystem because crates of different editions interoperate inside one build.
- explicitcorroboratedRust is now a category — 'reliable AND performant' — that previously did not exist as a single language choice.
- explicitcorroboratedRust may be unusually well-suited to AI-assisted coding because the compiler's rich feedback gives agents an objective, automatable corrector.
- implicitThe economic case for Rust is the cost of incidents, not the cost of typing — 'waking up at night' is the unit of value Alice anchors to.
- implicitRust's design philosophy is empirical-corrective: look at recurring failure modes across languages, then make each one a compile-time error.
- implicitAdopting Rust requires an organizational shift in where 'design effort' is spent — upstream into types and data structures rather than downstream into runtime defense and incident response.
- implicitCargo's centralized fetch-and-run model imports the npm-style supply-chain risk that Linus rejects, but the Rust community has not yet shown it can handle that risk better than npm has.
- explicitRust is unsuitable for the frontend; the WebAssembly path has not closed the gap with TypeScript.
2026-04
- explicitdevelopedMemory-safe languages do not eliminate vulnerability classes — the VMM bug exists in Rust unsafe blocks, which are unavoidable for hardware-level code
2026-05
- explicitdevelopedFalse-positive rate from security LLMs is dominated by two factors: programming-language memory safety (C/C++ produce more false positives than Rust) and model hedging bias.
2026-07
- explicitdevelopedLocal-first is a set of principles and values rather than a protocol, realized by libraries such as Automerge — an open-source CRDT data model (Rust compiled to WebAssembly, with Swift/Java/Python/Go/C bindings) that auto-syncs across machines and supports both real-time collaboration and version-control workflows across many file types.
- explicitcontestedA large, mature production codebase (Bun, 535,496 lines of Zig) can be rewritten to a different language (Rust) in about 11 days by one domain expert directing 64 parallel AI agents for $165,000 in API-price tokens — a migration that, done by hand, would have needed a small team of engineers roughly a year while freezing bugfixes, security fixes, and features.
2026-08
- explicitReturning to hand-coding hobby projects (a Playdate game-programming book, a Rust/Lua game engine) during his low point restored his enjoyment of programming and confirmed that AI use had been degrading both his craft and his mental state.
2026-09
- explicitThe AI-assisted rewrite of Bun from Zig to Rust was completed and released (v1.4.0) about four months after it began, versus an estimated one year for a small human team.
- explicitRust's compiler-enforced ownership/borrow-checking converts a recurring class of memory bugs (use-after-free, double-free, forgot-to-free on error paths) into compile errors, which the author considers a better feedback loop than a style guide.
- explicitPlanning artifacts (PORTING.md mapping Zig-to-Rust patterns, LIFETIMES.tsv documenting struct-field lifetimes) were key success factors — the planning phase mattered as much as execution.
- explicitThe Rust rewrite (Bun v1.4.0) fixed 128 longstanding bugs from v1.3.14, eliminated native memory leaks (stable at 609MB vs. climbing past 6.7GB across 2,000 consecutive Bun.build() runs), and improved HTTP throughput by 2-5%.
- explicitcontestedBugs and correctness in a large codebase come from dedicating engineering resources to catching them, not from which programming language or automated verification method is chosen — and it is inconsistent to argue the old test suite didn't catch all the Zig bugs while trusting that same suite is sufficient to validate a million new lines of Rust.
- explicitBoxing larger Rust enum variants — the intuitive move to shrink stack size — was ultimately a net loss, because the separate heap allocations it introduced added overhead and reduced memory locality.
- explicitdevelopedFull system rewrites driven by 'let's just rewrite everything in Rust because it's fast' are error-prone in practice: they blow past deadlines, turn out more complicated than expected, and often reintroduce bugs the old system had already fixed because a lot of institutional knowledge is encoded in old code, not just cruft.
- explicitThe best candidates for this technique are dynamic languages with strong Rust FFI tooling and a large speed gap versus Rust (Ruby, Python, Node.js, Lua); Go is a poor candidate despite being slower than Rust because its runtime makes C FFI expensive and awkward; C/C++ have good tooling but too small a speed gap over Rust to be worth the trouble for this purpose.
- explicitThe headline function-level speedup (~100x in this example) substantially overstates the real-world payoff; the macrobenchmark of the full HTTP request (~15%, later ~20% after also moving JSON serialization to Rust) is the number that should drive investment decisions, because most of the request's time is spent in Flask/JSON/Python overhead unrelated to the rewritten function.
- explicitThis is not a purely theoretical technique: Discord's real-time engineering team has used a similar Python/Rust FFI pattern in production to cut CPU/infrastructure costs on critical systems.
- explicitPyO3 mostly avoids copying data across the Python/Rust boundary by handing Rust pointers into Python-owned memory, but working on that data from a new Rust-spawned thread (rather than the calling thread) requires either a copy or explicit interaction with Python's GIL.
- explicitRust's lack of an exception mechanism is well-suited to FFI boundary code: errors-as-values naturally bubble up to a single conversion point where they become a Python exception or log entry, rather than needing to be caught at arbitrary points.
- explicitcontestedBun's rewrite of its codebase from Zig to Rust (heavily AI-assisted) was not fundamentally about Zig's language features being technically inferior to Rust's for Bun's purposes; the real divergence was between the two projects' value systems.
- explicitKelley began building Zig because no existing language satisfied the requirements of a native, low-latency digital audio workstation: JavaScript lacked low-level hardware control, Go's stop-the-world garbage collection broke real-time audio, pre-1.0 Rust's borrow-checker friction stalled UI font-rendering work for weeks, and C++ produced persistent, time-consuming memory-corruption bugs.
Open gaps (15)
- incompleteThe paper doesn't discuss the implications for memory-safe language migration strategies. If the remaining vulnerability surface is increasingly in unsafe blocks (as the VMM case shows), does the industry need to rethink how unsafe code is audited, isolated, and minimized? The 'just rewrite in Rust' narrative needs updating given that Rust's unsafe blocks are now a primary target.Assessing Claude Mythos Preview's cybersecurity capabilities — read next: Rust safety literature; formal verification of unsafe blocks; the 'unsafe Rust' audit ecosystem
- uninformedThe $165,000 token cost is reported 'at API pricing' without noting whether this reflects a subsidized internal rate (Bun/Anthropic are commonly owned), nor is any counterfactual maintenance-cost comparison offered for continuing to hand-fix the original Zig memory bugs over time.Bun Rewrites 535K Lines of Zig into Rust in Four Months, Eliminates Numerous Memory Leaks — read next: See the companion gap already recorded on the same underlying event in extract-pragmatic-engineer-anthropic-building-software#g3.
- uninformedBig Pineapple is said to store "more than 250 billion DNS cache entries at any given time," but the article never clarifies whether this is a concurrent global fleet-wide figure or a per-region/per-shard figure. Given the per-instance memory numbers reported (9.3 GB → 5.3 GB p99), readers cannot reconcile the two into an actual entries-per-instance count, which would be needed to sanity-check the per-entry footprint math end-to-end.Cloudflare Cuts 100 TB of Memory from 1.1.1.1 DNS Cache — read next: Cloudflare's original linked blog post (blog.cloudflare.com/dns-cache-memory-optimization-1111/) likely has the sharding/fleet-topology math needed to reconcile these figures.
- illogicalThe article gives a single, anonymous, unelaborated Reddit comment the same narrative weight as Cloudflare's own instrumented microbenchmark and seven-week production rollout data — quoting it as a peer counterpoint to the engineer's LinkedIn quote, without noting the wildly mismatched evidentiary standard (no data, no named author, no verification) or attempting to quantify, test, or rebut the scale-dependence claim it makes.Cloudflare Cuts 100 TB of Memory from 1.1.1.1 DNS Cache — read next: None needed to see the flaw — it's internal to the piece's own sourcing choices. A follow-up would be independent benchmarks of similar enum-boxing-avoidance techniques at smaller (non-hyperscaler) request volumes, to actually test the commenter's claim rather than just repeat it.
- illogicalThe talk asserts the bug-introduction risk is lower at function scale than for a full rewrite (proposition p5) but never actually demonstrates this — no comparative data, incident rates, or even an anecdote of a bug this technique introduced. The claim rests entirely on 'smaller scope, therefore safer' intuition, which the talk does not test against the possibility that FFI boundaries introduce their own novel bug class (memory/lifetime mismatches, GIL misuse, silent numeric divergence as actually shown) that a same-language refactor would not.Presentation: Accelerating Performance by Incrementally Integrating Rust Into Existing Codebase — read next: Read practitioner postmortems specifically about FFI-boundary bugs (use-after-free across a Python/Rust boundary, GIL deadlocks, ABI mismatches) to test whether 'smaller unit of change' actually implies 'lower risk' once the risk profile of the boundary itself is counted.
- uninformedDeployment and dev-environment complexity are named as costs but never quantified or walked through concretely (e.g. what a CI pipeline that cross-compiles Rust wheels for every supported OS/architecture actually looks like, how long that adds to build times, what happens when a contributor's machine can't match a required target triple).Presentation: Accelerating Performance by Incrementally Integrating Rust Into Existing Codebase — read next: Read maturin/PyO3's own packaging documentation and case studies (e.g. cryptography, polars, pydantic-core) on multi-platform wheel-building pain, to fill in the concrete operational cost this talk only names in the abstract.
- uninformedThe article cites developers "calling for a prioritised migration toward memory-safe alternatives" without engaging the feasibility, cost, or precedent of rewriting a thirty-year-old, performance-critical C codebase like FFmpeg, nor whether memory-safe languages would even close this specific vulnerability class.AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC — read next: extract-assessing-claude-mythos-cybersecurity-capabilities#p10 — "memory-safe languages do not eliminate vulnerability classes; the VMM bug exists in Rust unsafe blocks, which are unavoidable for hardware-level code" — directly complicates the migration narrative this article raises but never examines. Also extract-pragmatic-engineer-rust-alice-ryhl#g4 on the general evidentiary weakness of memory-safety cost-of-incident claims.
- incompleteThe category of bug Rust does NOT prevent is left implicit. Logic bugs, mis-modeled domains, distributed-systems race conditions across services, mis-handled business invariants — these are arguably the dominant cost in modern backends, and Rust's compile-time machinery does not touch them. Yet the conversation rhetorically positions Rust as 'reliable' full stop.Why Rust is different, with Alice Ryhl — read next: Read Hillel Wayne on formal methods and where types stop helping; Rich Hickey 'Simple Made Easy' on complexity that types don't catch; recent work on property-based testing (Hegel/Hypothesis — sponsor of this very episode, interestingly).
- incompleteThe organizational shift Rust demands is gestured at ('change the struct, not the code') but never made explicit. Adopting Rust seriously means moving design effort upstream — into types and ownership topology — which has real implications for who designs, when, and how PRs are reviewed. The conversation treats this as a personal learning curve when it is plausibly a team-process redesign.Why Rust is different, with Alice Ryhl — read next: Read Kent Beck on where in the design timeline to invest effort (Tidy First?), Yourdon & Constantine on coupling/cohesion as the unit of design, and Ousterhout's 'A Philosophy of Software Design' on deep modules — then ask: in a Rust shop, who owns ownership decisions, and when?
- incompleteThe cost-of-incidents argument is anchored to a Western, large-company threat model ('don't get woken up at night,' 'don't ship a CVE,' 'don't lose root'). It would be much stronger framed against actual cost-curve data: how much do memory-safety CVEs cost on average, what fraction of Google/Microsoft/AWS incident postmortems involve memory bugs, what's the marginal Rust dev-hour cost per prevented incident? Alice alludes to '~70% of Microsoft/Google bugs are memory bugs' folklore without citing.Why Rust is different, with Alice Ryhl — read next: Read the Microsoft Security Response Center memory-safety report (the source of the 70% figure), Google's Android memory-safety post-Rust adoption data, the CISA secure-by-design memo, and the US DoD/NSA memory-safety guidance Alice alludes to.
- incompleteThe Cargo/npm risk parallel is acknowledged and immediately dropped. Given the kernel's explicit rejection of fetch-and-run package management (Linus's anecdote), Rust's strategy for supply-chain integrity is load-bearing for any organization considering it for security-sensitive code — yet the episode offers nothing beyond 'it's a hard problem.'Why Rust is different, with Alice Ryhl — read next: Read crates.io's threat model docs, the Cargo audit/cargo-vet tooling, Linux distributions' approaches to vendoring Rust crates, and recent academic work on the npm/PyPI/crates supply-chain attack surface.
- incompleteThe Rust-and-AI thesis ('compiler-as-leash for agents') is asserted but not pressure-tested. Crucially absent: what happens when the agent reaches for `unsafe` to satisfy the compiler? What happens when the agent's chosen data structure is the wrong one and the compiler keeps approving — but at the cost of forcing Arc<Mutex<...>> everywhere? The compiler can't catch 'this struct shape was a bad idea.'Why Rust is different, with Alice Ryhl — read next: Look for empirical evaluations of AI coding agents in Rust vs in Go/TypeScript (recent benchmarks from Anthropic/OpenAI/SWE-bench-Rust), and pair with vibe-coding critiques like Steve Yegge / Gene Kim — exactly what Kjetil is already reading.
- uninformedGergely floats 'is Rust uniquely good for agents because of compiler feedback?' and neither speaker has data; Alice has 'tried to use them' but is 'still learning.' This is a place where the conversation would have benefited from a third voice with measured agent-on-Rust experience.Why Rust is different, with Alice Ryhl — read next: Recent reports/benchmarks on agentic coding by language (e.g. METR/Anthropic, Cursor postmortems, the Aider language-success-rate leaderboard) would directly fill this.
- illogicalThe phrase 'when it compiles, it works' is acknowledged-in-quotes but then deployed as if it were literally true (Alice's refactoring anecdote, Gergely's monologue). This conflates 'no bugs in the bug-classes Rust catches' with 'no bugs at all.' For an audience of senior engineers, the difference matters and the slippage is rhetorically convenient.Why Rust is different, with Alice Ryhl — read next: Read any survey on bug-class distributions in production systems; pair with Brian Goetz / Bjarne Stroustrup commentary on the limits of static typing.
- incompleteGeneralizability across stacks is asserted by silence. Cloudflare's codebase — heavily Rust, well-documented, with explicit trust boundaries and the discipline that comes from running a global edge network — is unusually well-suited to the harness as described. Whether the same harness pays off on a typical enterprise Java monorepo with sparse documentation and ambiguous trust boundaries is an open empirical question.Project Glasswing: what Mythos showed us — read next: Look for similar reports from non-Cloudflare practitioners (Google Project Zero, Microsoft, GitHub Advanced Security with Copilot Autofix at scale) using comparable harness architectures; pair with Böckeler on variety reduction as the precondition for any harness to work.