I use C when I believe in memory safety
I am more paranoid and cautious than, say, 95% of the programmers I&#x27;ve known. Maybe more. I <i>still</i> don&#x27;t trust myself to write safe C.<p>Specifically, I do not think I&#x27;m smart enough to violate the Chrome team&#x27;s Rule of 2: <a href="https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;docs&#x2F;security&#x2F;rule-of-2.md" rel="nofollow">https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;docs...</a><p>&gt; The Rule Of 2 is: Pick no more than 2 of untrustworthy inputs; unsafe implementation language; and high privilege.<p>I do know of a few C programmers I&#x27;d trust: DJB, many of the OpenBSD team, the Dovecot maintainers, and a few others with long track records of security.<p>But I don&#x27;t trust myself because I&#x27;ve used fuzzers on my <i>Rust</i> code, trying billions of inputs. And I&#x27;ve found DDOS bugs that would have been potential exploits in C.<p>What&#x27;s more damning, the <i>most</i> careful C code I ever wrote has an enormous, sneaky test suite. It was tested with every sanitizer I could find. It used carefully designed error handling conventions. Still, in the last 20 years, it has been the subject of several CVEs. You see, I relied on a high-quality 3rd party XML parser, and that parser had a handful of bugs.<p>Out of 7 billion people on this planet, the number that I&#x27;d personally <i>trust</i> to reliaby write CVE-free C code is in the low triple digits. I&#x27;m not one of them.<p>Understanding Rust is a cakewalk compared to understanding &quot;undefined behavior&quot; in the C standard, or to making sure a large C program <i>never</i> overflows an addition, or accesses memory out of bounds. But Rust is not the only option. Use Go or Java or Ada SPARK or a functional language or WUFFS. Any are fine.<p>As an industry, we need to stop making the same endless security mistakes. It&#x27;s not OK.