Baby Steps: Slowly Porting Musl to Rust
While Rust can indeed provide great benefits over C in many respects (mostly security and safety, but also maintainability), rewriting &quot;everything&quot; in Rust, as the author says, is so monumental an effort that there is no chance of it happening, certainly not before a &quot;better&quot; language than Rust comes along (say, in another ten or fifteen years), and then what? Rewrite everything in that language?<p>A far more feasible approach (though still very expensive) -- and probably a more &quot;correct&quot; one, even theoretically -- is to verify existing C code using some of the many excellent verification tools (from static analysis to white-box fuzzing and concolic testing) that exist for C[1]. It is more &quot;correct&quot; because, while perhaps not providing some of the other benefits, those tools can prove more properties than the Rust type system can, and such tools don&#x27;t (yet) exist for Rust.<p>Even if you want to write a green-field project today that absolutely must be correct, it&#x27;s better to do so in C (or in some of the verified languages that compile to C, like SCADE) and use its powerful verification tools, than to write it in Rust. Verification tools are usually much more powerful than any language feature (even though Rust&#x27;s borrowing system seems like it can prevent a lot of expensive real-world bugs). Of course, it would be optimal if we could do both, but the Rust ecosystem simply isn&#x27;t there just yet.<p>This is part of a more general problem, namely that rewriting code in new languages -- any new language -- is <i>so</i> costly (and often risky, too), that the benefits are rarely if ever commensurate with the effort. This is why good interop with legacy libraries is so important (something, I understand, Rust does well), often much more important than most language features. Rewriting code is often the worst possible way to increase confidence in a library&#x2F;program in terms of cost&#x2F;benefit, both because verification tools are often more powerful than any language feature, as well as because new bugs are introduced -- either in the code or in the compiler (bugs that won&#x27;t be uncovered by the usually incomplete legacy test suite, but would break some of the millions of clients). Rewriting is usually worth the effort if the codebase is about to undergo a significant change anyway, but almost never to increase confidence in the existing functionality.<p>EDIT: Clarification: if you&#x27;re <i>not</i> going to use verification tools in your <i>new</i> project, anyway, than obviously using Rust would give you much better guarantees than C.<p>[1]: C and Java are the languages with the best collection of powerful verification tools (maybe Ada as well, but there&#x27;s far less Ada code out there than C or Java).