Tor in a safer language: Network team update from	Amsterdam
Since bitexploder asked, I&#x27;ll add what I wrote on this on other forums. If it&#x27;s about secrets or anonymity, make sure you always use a safe language that supports careful control and reasoning about both memory and CPU time. The reason is that this enables covert, channel analysis for vulnerabilities that leak secrets through storage and timing. It&#x27;s why I wanted Freenet to ditch Java aside from the obvious reasons. It&#x27;s also why GC languages such as Go are better not used. Although, memory management where programmer controls timing &amp; it&#x27;s simple to analyze might be used. Reference counting comes to mind.<p>The other thing you want is proven, successful use in high-assurance systems. That is, systems that either didn&#x27;t fail or provably couldn&#x27;t in certain ways. These are almost all written in a subset of C or Ada&#x2F;SPARK. The advantage of using those is you can combine them with a vast array of proprietary or open-source tooling to catch about any error you can think of if it&#x27;s implementation. There&#x27;s also formal specification and protocol analysis tools that combined with expert review can catch the rest. Rust, although a good choice for increased safety&#x2F;security, doesn&#x27;t have such tooling yet. That means they will get less correctness overall and over time vs MISRA-C or Ada&#x2F;SPARK unless similar ecosystem in industry and CompSci emerges for Rust. That&#x27;s why I recommend against it for high-assurance security for now.<p>It does seem good for medium-assurance security where you want to knock out low hanging fruit in systems code. It will avoid serious errors in C while providing additional benefits with type system and other features. Ada 2012 + SPARK 2014 are the standard for safe systems since they systematically eliminate all kinds of errors with a consistent design and tooling with decades of field success. I haven&#x27;t seen a direct comparison with Rust on each protection to see if it matches it already or not. The main advantages Rust has over them are its borrow-checker for temporal safety, more usable method for safe concurrency, and (best for last) highly-active community to provide libraries or help. Go has similar benefits if its GC works with your use case but a lower, learning curve &amp; possibly lower efficiency. Due to ecosystem benefits, these are main two I&#x27;m recommending for medium assurance if Ada&#x2F;SPARK are too much to learn.