HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
rust-lang
unsafe-code-guidelines
Learning & Reference2019–2026
rust-lang / unsafe-code-guidelines

unsafe-code-guidelines

Forum for discussion about what unsafe code can and can't do

Learning & ReferenceCommunication & Social
Explore on GitHubRead Hacker News discussions
13Distinct people
17Mentions
0Explicit recommenders
756GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Forum for discussion about what unsafe code can and can't do

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year17 dated mentions

Observed mentions: 2019-08-30 09:11:34 UTC to 2026-10-14 02:47:02 UTC.

012342019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC303
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC202
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC404
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC202
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC202
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

What Hacker News says

17 sources
nextaccountic·Oct 14, 2026
> It's fascinating that this kind of bug is exactly you can't really avoid even when rust is supposedly to guard against. Note that Rust is not a theorem prover and Rust programs are usually not formally verified (there are some extensions like Creusot to verify Rust programs, but they are incomplete and a work in progress) Compiler bugs are, like, just logic bugs. There's a project to eliminate compiler bugs that cause unsoundness, project zero [0] but, still, without formally verifying the implementation, there is nothing really guaranteeing there's no such bugs left. (note: unsoundness in this context means having safe code cause UB due to a compiler bug; the fix is usually to make the compiler reject the code with a compiler error) To make matters worse, Rust still doesn't have a spec, and there is not even a tight definition of what
Read the rest
are the rules of unsafe code - that is, what rules you must follow so that you unsafe code doesn't trigger UB. Discussions around this are done mainly in issues of the unsafe code guidelines repo [1] [0] https://goals.rust-lang.org/2026/roadmap-project-zero.html https://github.com/rust-lang/unsafe-code-guidelines/issues
In 11 year old unsoundness bugs found in Rust borrow checker
NobodyNada·May 21, 2025
It's an open question whether creating a reference to an uninitialized value is instant UB, or only UB if that reference is misused (e.g. if copy_to_slice reads an uninitialized byte). The specific discussion is whether the language requires "recursive validity for references", which would mean constructing a reference to an invalid value is "language UB" (your program is not well specified and the compiler is allowed to "miscompile" it) rather than "library UB" (your program is well-specified, but functions you call might not expect an uninitialized buffer and trigger language UB). See the discussion here: https://github.com/rust-lang/unsafe-code-guidelines/issues/3... Currently, the team is leaning in the direction of not requiring recursive validity for references. This would mean your code is not language UB as long as you can assume
Read the rest
`set_len` and `copy_to_slice` never read from 'data`. However, it's still considered library UB, as this assumption is not documented or specified anywhere and is not guaranteed -- changes to safe code in your program or in the standard library can turn this into language UB, so by doing something like this you're writing fragile code that gives up a lot of Rust's safety by design.
In Writing into Uninitialized Buffers in Rust
NobodyNada·Mar 16, 2025
This is definitely true right now, but I don't think it will always be the case. Unsafe Rust is currently extremely underspecified and underdocumented, but it's designed to be far more specifiable than C. For example: aliasing rules. When and how you're allowed to alias references in unsafe code is not at all documented and under much active discussion; whereas in C pointer aliasing rules are well defined but also completely insane (casting pointers to a different type in order to reinterpret the bytes of an object is often UB even in completely innocuous cases). Once Rust's memory model is fully specified and written down, unsafe Rust is trying to go for something much simpler, more teachable, and with less footguns than C. Huge props to Ralf Jung and the opsem team who are working on answering these questions & creating a formal specifi
Read the rest
cation: https://github.com/rust-lang/unsafe-code-guidelines/issues
In Zlib-rs is faster than C
lifthrasiir·Sep 4, 2024
I never heard of "German strings" in place of the small string optimization before! And there had been way too many proposals to add such types to the standard library [1] [2] [3] [4]. My understanding is that: 1. Both `Vec<u8>` and `String` should share the same layout as part of the standard library's contract. 2. Unlike `String`, the equivalent optimization for `Vec<T>` is more questionable especially when T might be any type. C++ standard libraries frequently do implement multiple layouts for std::string but not for std::vector<T> for the same reason. 3. Rust never allows an implicit copying of `String` in the first place, which greatly benefits from the SSO, so the lack of SSO in Rust is less important compared to C++. [1] https://github.com/rust-lang/rust/issues/4991 [2] https://github.com/rust-lang/rust/issues/20198 [3] https://git
Read the rest
hub.com/rust-lang/rfcs/pull/2990 [4] https://github.com/rust-lang/unsafe-code-guidelines/issues/4...
In An Optimization That's Impossible in Rust
DSMan195276·Aug 3, 2023
> Have you written unsafe code in Rust? I have some experience writing unsafe code, and most of the time you can do it without problems Yes, I've written a decent amount of `unsafe` code. And I would also point out, C programmers say the same thing about their code :P The problem comes when an assumption you thought was ok turns out to be something the compiler writers thought you shouldn't do, and then your code is broken. Rust doesn't have a defined list of invariants you can't break in `unsafe`, which makes it pretty hard to be confident you didn't break one of them. I've loosely followed the work to pin down some of these things[0], but I don't personally feel like tons of progress has happened and they've been working on it for years. That said don't get me wrong, I like Rust, I just wish the `unsafe` situation was improved. I also a
Read the rest
gree that creating safe APIs around `unsafe` code is the way to go, but I've seen a whole bunch of people get it wrong due to bad advice given around `unsafe` or lack of clarity around what `unsafe` is actually supposed to mean. `unsafe` has also IMO been overloaded to mean both "this code does one of the unsafe operations" or "this code has some invariant you must keep". The latter tends to be the better way to go for creating APIs, but is also harder to do and ends up causing you to mark completely safe code with an `unsafe`. [0]: https://github.com/rust-lang/unsafe-code-guidelines
In Why Rust helps even if you have to use a lot of `unsafe`
nyanpasu64·Jun 27, 2022
To elaborate, there is a recurring trend of sound C programs turning into unsound Rust programs, because shared mutability is often necessary but Stacked Borrows places strict conditions on constructing &mut T (they invalidate some but not all aliasing *const T), and it's less ergonomic to work solely in raw pointers and avoid creating Box<T> or long-lasting &mut T (or for intrusive collections, any &mut T at all). For example, matklad (the author of rust-analyzer, one of the preeminent Rust programmers and someone I'd expect to get code right) made a recent blog post on "Caches In Rust" (https://matklad.github.io/2022/06/11/caches-in-rust.html). The cache is built around https://docs.rs/elsa, which is built around https://docs.rs/stable_deref_trait/latest/stable_deref_trait..., which is unsound for Box and violates stacked borrows in its
Read the rest
current form (https://github.com/Storyyeller/stable_deref_trait/issues/15). However, the rules may be relaxed or more ergonomic alternatives added (https://github.com/rust-lang/unsafe-code-guidelines/issues/3...), it's uncertain right now. (Also I go by "they".)
In Build a PinePhone App with Zig and Zgt
nyanpasu64·Feb 19, 2022
I think it's easier to write correct safe Rust than C, I wouldn't say it's easier to write correct Rust with unsafe blocks than C (many operations strip provenance, you can't free a &UnsafeCell<T> created from a Box<T>, you can't mix &mut and const but you might be able to mix Vec<T> and const (https://github.com/rust-lang/unsafe-code-guidelines/issues/2...), self-referential &mut or Pin<&mut> is likely unsound but undetermined), and it's absolutely more difficult to write sound unsafe Rust than C (sound unsafe Rust must make it impossible for callers to induce UB through any possible set of safe operations including interior mutability, logically inconsistent inputs, and panics).
In ‘Zero-click’ hacks are growing in popularity
DSMan195276·Jan 31, 2022
I feel like you're ignoring the actual history here, these are a few excerpts from right before the 1.0 release of Rust[0]: > Rust has remained true to its goal of providing the safety and convenience of modern programming languages, while still offering the efficiency and low-level control that C and C++ offer. > When used in its own most minimal configuration, it is even possible to write an operating systems kernel in Rust. > The resulting design is not only simpler to learn, but it is also much "closer to the metal" than we ever thought possible before. All Rust language constructs have a very direct mapping to machine operations, and Rust has no required runtime or external dependencies. They do actually have a group working on making `unsafe` better, so they do somewhat recognize the problem (I'm not sure about the results, but the
Read the rest
last time I looked at it was probably over a year ago): https://github.com/rust-lang/unsafe-code-guidelines Perhaps another catch is that, at least in my experience, the most common situation where `unsafe` can into play is interop with other languages/libraries/etc.. Some of it is avoidable, but a certain amount of it is necessary just be able to interface with existing non-Rust code, so it's not really optional in those situations. Also, just to be clear, I do actually like Rust, and I've written a few different things in it. I just think the state of `unsafe` is poor to the point that it's very hard to determine if you're doing something correctly, which in my opinion makes unsafe unusable for its purpose. [0]: https://blog.rust-lang.org/2014/09/15/Rust-1.0.html Edit: To be clear, I'm not attempting to defend Actix, that was silly. I'm just talking about situations where unsafe is unavoidable, which really covers a lot of potential usages of Rust.
In Uninitialized memory: Unsafe Rust is too hard
natded·Dec 19, 2021
One of the best post-beginner / intermediate learning experiences wrt. Rust is to try to model the Borrow Checker behavior with Rust. Just write small (>10 LoC) programs within safe subset of Rust: 1. Rejected unsafe programs (and the why) 2. Rejected safe programs (and the why) .. and try to convince yourself that you understand the logic behind the two. https://whileydave.com/2021/12/06/modelling-borrow-checking-... https://github.com/rust-lang/unsafe-code-guidelines/blob/mas...
In Thread Safety in C++ and Rust
valenterry·Jun 28, 2021
To my knowledge, Rust's macros are not generally safe/sound by definition. And that can be a big problem down the line. Compare it to Scala. When they developed Scala 3, they changed macros and dropped a lot of their powers to make the safe/sound by definition and compatible with the typesystem. But they are now severely restricted when compared to Lisp macros. EDIT: here's an example of a discussion about that in Rust: https://github.com/rust-lang/unsafe-code-guidelines/issues/2...
In BLisp: A Statically Typed Lisp Like Language
fluffything·Aug 22, 2020
> There is no debate about this. Of course there is, for example, the offset_of! macro was unsound for a long time: * https://internals.rust-lang.org/t/pre-rfc-add-a-new-offset-o... * https://github.com/rust-lang/unsafe-code-guidelines/issues/1... * https://github.com/rust-lang/unsafe-code-guidelines/issues/2... * https://github.com/rust-lang/rust-memory-model/issues/35 > You didn't really answer my question. I literally wrote "No.". To your follow up questions starting with "If so ..." i did not reply, because the assumption these questions were based on (that I would reply to the previous question with "yes") did not hold. To expand on this. Rust does not have "unsafe macros", so all exported macros must be sound. Whether a macro is sound or not is orthogonal to whether the macro itself uses `unsafe` (and your original claim was whethe
Read the rest
r I thought that macros containing unsafe should be rejected by the compiler, to which I replied "No.", `pin_mut!` is an example of a macro that uses `unsafe` and is sound).
In AutoCXX: Safely call C++ from Rust with auto generated bindings

Showing the 15 most recent of 17 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.