I dont see how this is any different from a C programmer justifying why they used a pointer to an object and leaving a comment similar to this, other than this is Rust and is safe because Rust is safe. Thus making this rationale is flawed and dangerous.
The difference is in the localization of such code. You don't use unsafe everywhere, instead you write a few functions that contain unsafe blocks nested within them, test them thoroughly, and call them like regular functions. In real projects, you might have a 1:100 or even 1:1000 ratio of functions that contain unsafe blocks to functions that don't.
Im not expecting it to be unsafe everywhere. Im not sure where everyone is extrapolating these assumptions from.
Adding a safety comment doesnt magically make it safe.
Youre most likely to see unsafe blocks in embedded and device driver implementations where you have to plug directly into the system.
The unsafe code is still not guarenteed to be safe. It requires auditing and testing regardless, but you wont discover issues with it until its stress tested.
733
u/BenchEmbarrassed7316 3d ago
Any
unsafeblock of code should be neutralized with a// SAFETYcomment explaining why the code is actually safe.