Too much kool-aid

I only work with single-threaded projects at the moment. That aspect is not very appealing to me at the moment.

> * The callee can be sure that it is not responsible for freeing `s`

Consistent use of the [[gnu::malloc(free)]] attribute can help with that too.

---

Look, Rust does have very good ideas. I don't claim it doesn't. But:

- You can improve your C code's safety significantly just by designing good APIs and self-limiting to a subset of the language.

- As a longer-term goal, you can probably add those Rust features to C.

In the end, a safe language is a language that prevents you from accidentally granting rights to an attacker.

You may call it luck, but I have been refactoring shadow-utils at a very high rate (including complaints by packagers that were worried that such rate of churn would introduce security vulnerabilities almost certainly) for quite a few years already. So far, I have introduced 0 remote holes in a heck of a long time (at least, for what we know). The code is now significantly safer than it was before I started. The more I refactor it, the safer I feel when doing so. You just need to follow some rules, and at least you'll have a hard time introducing a vulnerability. It's not impossible, but it's all a compromise.

I know the language so damn well that that offsets the theoretical benefits that Rust could give me. People talk their mother tongue better, even if it's significantly more complex than other languages, because they know it by heart. They say Norwegian is similar to English but simpler (and thus easier), but we speak English because we already know it. Would it be better if there was a big-bang change in the world to make Norwegian the global language? Maybe it would help learners in the long term, but we'll agree that it's not a good idea. The same holds for Rust and C, IMO.

Plus, for a setuid-root set of programs (which is what I'm mainly working on at the moment, apart from the Linux man-pages project), a logic error is as bad as a buffer overflow. If I toggle a conditional and grant root privileges to a random user in su(1), I've screwed as badly as if I would have caused the worst UB. That also diminishes the reasons for using Rust, _in my case_.