> That also ignores known soundness holes, compiler errors, and silliness like how rust binaries leak the file structure they were built on All these issues I'

> That also ignores known soundness holes, compiler errors, and silliness like how rust binaries leak the file structure they were built on All these issues I've encountered, or heard of, while working on MISRA-compliant code which is expected to run in cars for years without updates. We make do with C, and extensive tests + ASAN/UBSAN/TSAN can take us a long way, but my point is that Rust is a nice incremental step compared to C. I'm not excluding F* from the list of nice incremental steps, and if the developer ecosystem is there maybe that is a compelling option. My other point is that MISRA C helps enforce standards in some of the nasty codebases that run in cars, and trust me they can be scary, but it is only a band-aid and I believe that Rust is generations ahead of it. > but auto industry standards are not reasonable or a language with a garbage collector is not reasonable. We avoided garbage collection because the run-time is harder to predict, and at the same time Java/Android is used a lot in the infotainment units which are now also running some safety-critical code - with a back-up computer thank you standards - and it makes it harder to allocate resources on the embedded system accordingly. I will admit I'm all for Rust and will likely try to seek out jobs which I get to use it in.