"Sometimes" and "kind of" are doing a lot of work there. In reality most Rust code hardly ever needs to be unsafe and the existence of unsafe code in libraries

"Sometimes" and "kind of" are doing a lot of work there. In reality most Rust code hardly ever needs to be unsafe and the existence of unsafe code in libraries you use hardly ever has any impact on the security and stability of what you ship, because there just isn't very much of it compared to the safe code. The "trophy cases" for Rust fuzzing bear witness to this. > C codebases heavily utilise pointer arithmetic programming. You don't write unsafe Rust code everywhere C code would use pointer arithmetic. You use safe Rust idioms and APIs instead. If it turns out that writing Linux drivers in Rust requires writing a lot of unsafe Rust code in each driver, then that would certainly be a failure. I don't see any reason to believe that will be the case.