linked_list.rs once you strip the comments, struct defs, and whatnot out has 415 lines, of which 64 reside in unsafe blocks, 6x as much code to check. That's o

linked_list.rs once you strip the comments, struct defs, and whatnot out has 415 lines, of which 64 reside in unsafe blocks, 6x as much code to check. That's one trivial module. The piston modules and other c bindings have much worse ratios. When the amount of code that you have to verify manually jumps by 6x (or worse), that's surprising. I was surprised and troubled by that.