linked_list.rs once you strip the comments, struct defs, and whatnot out has 415 lines, of which 64 reside in unsafe blocks, 6x as much code to check.<p>That&#x27;s one trivial module. The piston modules and other c bindings have much worse ratios.<p>When the amount of code that you have to verify manually jumps by 6x (or worse), that&#x27;s surprising. I was surprised and troubled by that.