> For a server process the best reaction to a panic would mean abort and clean restart. That's often infeasible, and creates a major DoS/reliability problem.

> For a server process the best reaction to a panic would mean abort and clean restart. That's often infeasible, and creates a major DoS/reliability problem. The server may be processing hundreds of different requests at the same time, and panic=abort will kill all of them. That creates a visible failure to other unrelated clients of the server, not just the offending request. If you try to fix that and retry aborted requests, you'll retry the panic-inducing request and cause another failure (and it'll take several restarts to bisect out the offending request). Plus a restart may be costly, require loading data, warming up caches, etc. It's just way cheaper to catch a panic and return 500 to the offending request. Rust guarantees to panic before anything terrible memory-corrupting happens. Even if you don't trust it and would prefer to restart anyway, you have an option to gracefully hand over the traffic before the restart.