I disagree: this sort of operation that seems safe is some of the most deceptive code to write... there's always the risk of reading a little bit more than inte

I disagree: this sort of operation that seems safe is some of the most deceptive code to write... there's always the risk of reading a little bit more than intended or incrementing a pointer a little too far and hitting undefined behaviour. (There is in fact a bug (or two) in the type punning `read_u64` code, fortunately just a correctness one, but the small amount of code in that function is enough to obscure it, let alone the long sequence of copy-pasted `unsafe` code that makes up the main algorithm.) It is definitely a red flag for a function that just reads some bytes to be entirely wrapped in an unsafe block, and I don't think it makes sense to defend it while also saying that the Rust community discourages gratuitous use of `unsafe`. The whole point of Rust is the "experts know what they're doing" argument doesn't work in practice, and people shouldn't get a free pass for large amounts of seemingly undocumented and unjustified `unsafe` just because they have some prominent projects.