Two things here: 1. Restricting unsafe to limited number of places is a lot better than having it as a default everywhere. 2. The idea is that if you have to us

Two things here: 1. Restricting unsafe to limited number of places is a lot better than having it as a default everywhere. 2. The idea is that if you have to use unsafe, you (or some other module author) would wrap it in an interface that is safe to use. Overall this may not be perfect (in the sense of "its 100% verified by compiler") and finding bugs does happen in supposedly safe abstractions over unsafe, but Rust moves this from "its a norm" to "its very, very rare". 3. Unsafe lifts many restrictions, but not all of them, so there still is some validation. Keep in mind that GC and a large parts of low-level code that is fundamental for languages that have GC is written in C, and we still are findings safety bugs there.