What is Rust?

The fast, safe, super difficult to write programming language that’s finally getting its flowers.

If you haven’t read part 1, go do that, or you might be…rusty...

In part 1 I explained why there are so many different programming languages: because languages come with tradeoffs, and everyone wants to choose their tradeoffs differently. We discussed how memory and how it’s managed is one of if not the most important of those tradeoffs, and how when it comes to memory management you pretty much need to choose between your program being fast, or your program being safe.

The speed vs. safety thing was always around, but it was ultimately manageable. Slow safe programs were fast enough for most users, and fast unsafe languages could broadly keep up with the speed of attackers trying to exploit any memory-related vulnerabilities that snuck into production.

But the game hath changed. Today, increasingly lag-intolerant consumers rely on massive multiplayer games with millions of concurrent players, trading platforms where a millisecond of latency costs real money, and critical infrastructure that nation-states are actively and effectively hacking. Which begged the question (again): can we have a programming language that is both fast to write and safe from a memory perspective?

Rust is a programming language that says maybe you don’t have to choose.

It was created by a Mozilla engineer named Graydon Hoare, started as a personal project in 2006, got picked up by Mozilla as an official project in 2009, and hit its stable 1.0 release in 2015. It was built from scratch to be as fast as C and C++ while making an entire category of bugs impossible to write due to its unique approach to the memory problem.

To understand how Rust pulls this thing off, we need to go a little deeper on memory (again). What does it look like to write in a programming languages that do or don’t require you to manually work with memory?

First, the simpler one. In higher level languages like Python there is something called the garbage collector – a glamorous position if there ever was one. The garbage collector is a sort of “engine” that runs periodically in Python programs to help handle your memory for you. It scans your memory story and cleans it up. And much like a garbage truck if you’ve ever been stuck behind one while 10 minutes late for something important, it’s slow as hell because garbage collection is a computationally intensive task. Again, tradeoffs.

In a low level language like C, you must manually interact with the memory system, allocating data for each piece in your program. Before you can store a user’s birthday to display it to them in an app, you need to allocate a slot for it, and when you are done with the birthday, you need to release the memory. By allocating a slot, I mean literally telling the computer: hey, I need you to store this variable (an allocation), and it will require 8 bytes and data, and you should do it here in particular. And then Mr. Computer, when we are done with this variable, you should delete that data (a release). Like I said, computers both dumb and smart.

This manual process skirts around the garbage truck – which means it’s much faster while running – but it’s incredibly time consuming and error prone to write. If you miss an allocation or release anywhere in your code, it’s likely your program will crash or be vulnerable to hackers.

Like I said, for what seems like forever these were your two choices. Easy breezy but very slow garbage collection, or rigorous and fast but highly labor intensive (and vulnerable) manual memory allocation. Rust does a third thing.

What makes Rust, Rust

The entire point of Rust is to enable developers to write manually allocated code that’s safe. It’s all about avoiding the vulnerabilities and bugs that tend to happen when you have to manually allocate memory. Both ways, western man.

So Rust’s primary thing, the thing it will not stop talking about at parties, is that it approaches memory management differently. It aims to be fast, so runtime memory management (the garbage truck) like in Python is a no-go. But those damn lower level languages are so unsafe. I saw three of them go into the bathroom together!

Rust’s Raison d’être is the ownership system, which approaches our heralded tradeoff with a twist:

• You in fact do have to manage memory on your own. No garbage collection.

• BUT, instead of manual memory allocation being the Wild West, Rust gives you a helpful partner of sorts to do that with you.

Specifically, Rust elevates the role of the compiler from a simple translation machine to the world’s strongest and smartest bouncer. As you may recall, early computer scientists invented the compiler as the translation layer between human writable higher level languages and the 1s and 0s that the computer can actually run. The Rust compiler, however, does more than just translate.

Where older manually allocated memory languages like C allow whatever bugs you write to end up in the compiled program ready to leak data or get exploited, the Rust compiler has an extremely strict set of rules that code must adhere to before being compiled. You physically cannot ship the bug because the compiler won’t let you build a program that isn’t responsible in regards to memory.

“I don’t see how you can hate from outside of the club. You can’t even get in.”

- Chris Brown on his 2011 hit Look at me Now, and, the Rust compiler to improperly used memory

So you get the speed of C, because there’s no garbage collector running in the background, but you don’t get the myriad memory bugs that have plagued C and C++ codebases for decades. The amazing Rust compiler catches crashes from accessing memory you already freed, security holes from forgetting to clean something up, all of it, before a single user ever touches the code.

This fabulous compiler is not a silver bullet. The issue is that Rust, with all its rules and requirements, is hard to write. Despite this however, developers love Rust. It’s been the most loved programming language in Stack Overflow’s annual developer survey every year since 2016, and every year it seems like more and more of the world’s software is written, or rewritten in Rust.

The receipts: Rust in action

The fast, safe, and beloved language is finally getting its flowers in the form of massive grassroots community growth, adoption by hardcore and influential dev teams, and endorsement by standards organizations and governments.

For years, “Rewrite It in Rust” was a joke. Any time someone on the internet mentioned a performance problem, a security bug, or really any problem at all, a Rust evangelist would show up in the comments and suggest, with complete sincerity, that the solution was to rewrite it in Rust. It became a meme, then a term of light mockery for a certain type of engineer who had discovered a new favorite language and would not shut up about it. The Rust community even has a mascot, Ferris the Crab, and a habit of spamming the 🦀 emoji into threads where it is not needed or wanted.

But as the years scrolled by, the Rust-hater became the Rust-curious after Mozilla rewrote a major service in Rust and wrote a blog about it in 2017. The Rust-curious turned to Rust-fan after Dropbox called it a “force multiplier” for their core file syncing service, and little by little Rust has started eating the world, turning skeptics into believers, one codebase at a time.

• Discord rewrote the service that tracks who’s online and in which servers, switching from Go to Rust, and saw latency improvements so dramatic the periodic spikes that plagued the Go version disappeared entirely.

• Cloudflare rewrote a core piece of their network infrastructure and got 25% better performance at half the compute cost. Cloudflare sits in front of about 20% of all web traffic.

• Microsoft has been rewriting parts of Windows in Rust for years. The reason is that roughly 70% of the security vulnerabilities Microsoft has patched since 2006 trace back to memory safety issues.

• The Linux Kernel added Rust as a supported language in 2022 and researchers estimate it could eliminate around two-thirds of the security vulnerabilities in the components written in it.

• Hugging Face rewrote their tokenizer library in Rust, and it now processes a full gigabyte of text in under 20 seconds on a standard CPU, dramatically faster than the Python-based tokenizers it replaced.

But don’t take my word for it, take Uncle Sam’s. The federal government published a report in 2024 recommending that the software industry move away from C and C++ toward memory-safe languages, naming Rust specifically. The NSA and CISA have issued similar guidance. When the feds start weighing in on what programming language you should use, the meme phase is probably over.

The trolls who mocked rust and spammed the meme were right that you probably shouldn’t undertake a full rust rewrite to change the color of a button, but wrong about most of the rest. Rust didn’t come with a flashy million-dollar marketing campaign; it came with pudding… in which there was proof that if your users want snappy, secure software (and they do) Rust can help make that happen.

Lets try this again

I think now we’re ready for that definition of Rust.

Rust is a statically-typed, compiled programming language that enforces memory safety through compile-time ownership semantics without requiring a garbage collector.

If you ask me, Rust adoption will continue to rise for its killer performance, tight memory safety, and growing presence in systems-level infrastructure, but also due to the rise of LLM-generated code. The fact that Rust is hard to write was a significant barrier to entry when actual humans were coding. But LLMs don’t feel that friction the same way; they can bang out thousands of lines of Rust no problem, which effectively lowers the cost of choosing it. And there seems to be a calcifying effect around language choices, with LLMs knowing the most about the languages that already have the most code written in them. Rust has a large, high-quality open source footprint, which means models are well-trained on it.

There will likely be downstream consequences when it comes to maintaining the inevitable deluge of rust-slop given how steep the human rust-learning curve is, but in any case, we see no signs of slowing Rust’s massive growth in popularity.