I accept that criticism. It's just that it makes things more complicated and harder to argue about (and I couldn't remember the exact boundaries). I was makin

I accept that criticism. It's just that it makes things more complicated and harder to argue about (and I couldn't remember the exact boundaries). I was making the distinction earlier but dropped it for the sake of explaining the point of safe/unsafe. So the categories of code: the unsafe block, the friend code that shares responsibility for invariants, the outside world code Capricorn2481's mistake is putting the entire program in the second category, when only code in the same module is supposed to be there. If a memory violation happens, you know you have a bug in a module containing unsafe blocks, which helps a lot. Those modules should be relatively rare and as small as possible.