> When Rust calls into C code it completely loses almost all of its safety guarantees. Not really, it means that if there is a memory safety bug it must be eit

> When Rust calls into C code it completely loses almost all of its safety guarantees. Not really, it means that if there is a memory safety bug it must be either in an unsafe block or foreign C code (which also must be called in an unsafe block). While technically any C code could completely invalidate Rust's memory model, in practice that is almost always a C bug which you can debug more easily if much less of your codebase is in C (or equivalently, unsafe Rust). > Having a codebase which is half C and half Rust sounds worse to read and reason about than all either. I think that really depends how it's structured. You would probably want to avoid something like Rust calling C calling Rust calling C (calling Rust calling ... etc), but if the codebase is already separated into modules or even separate libraries you could rewrite a library or module while maintaining the same C API (and that Rust or C module can be read independently from the rest of the codebase).