> How do you know a function doesn't call unsafe code without looking at every function called in it, and every function those functions call, and so on? The p

> How do you know a function doesn't call unsafe code without looking at every function called in it, and every function those functions call, and so on? The point is that you don't need to. The guarantees compose. > The usual retort to these questions is 'well, the standard library uses unsafe code It's not about the standard library, it's much more fundamental than that: hardware is not memory safe to access. > If Rust did not have a mechanism to use external code then it would be fine This is what GC'd languages with runtimes do. And even they almost always include FFI, which lets you call into arbitrary code via the C ABI, allowing for unsafe things. Rust is a language intended to be used at the bottom of the stack, and so has more first-class support, calling it "unsafe" instead of FFI.