> 3) I'm not a Rust expert (however I know quite a bit of C and C++), but arguing that Rust isn't
> useful because some functions are marked "unsafe" sounds nevertheless ridiculous. Much C and
> C++ code is inherentely "unsafe", even if the word appears nowhere in the code. The fact that
> Rust makes you mark which precise operations are unsafe is already a step forward for maintainability.

That is huge problem for people like you. You should be an Rust expert to see whether they work. A lot of people including me quit Rust since you need too many unsafe and unwrap. The worst part is that unsafe + unwrap abuse that leads to a lot of double-free, since Rust's drop will continue execute in panic even itself panics. Those issues do not even exist in C++.

The ACM paper shows that not just purely unsafe could have CVEs. In fact safe->unsafe, safe->safe, unsafe->unsafe, unsafe->safe can all have CVEs. The safe->safe part CVEs come from the compiler bugs since modern compilers often did a lot of unproven optimizations that might contain cves in it. Of course this is the smallest one. However, the largest part is not actually unsafe themselves, majority of them are safe->unsafe, which completely break your assumption that you only need to grep unsafe part to see the CVEs.

The worst part is that the unsafe keyword makes the attacker's life easier too.

I hope Linus Torvalds himself should try to write some Rust to see whether he does not need a lot of unsafe or not. Unfortunately, most people particularly on the reddit or social media never use Rust by themselves. This is his project, he should make decisions for things he truly understand, not listen to social media which keeps spreading false information.


I am showing for all the research results and other people's research result.


You are talking about maintainability. Too many unsafes are nowhere good for maintainability. Not mentioning readability, cargo, micro dependencies, only targeting LLVM platforms. Also Binary bloat by introducing Rust fmt and all sorts of other Rust runtime. Rust program is super bloat too. You are not just using Rust, you still use C. The interpolation issues. Extremely slow compilation speed, even much worse than modern C++ since you need traits coherency.
These problems only increase maintainability, not reduce.