Safety in an unsafe world
Joshua Liebow-Feeser took to the stage at RustConf to describe the methodology that his team uses to encode arbitrary constraints in the Rust type system when working on the Fuchsia operating system (slides). The technique is not unknown to the Rust community, but Liebow-Feeser did a good job of both explaining the method and making a case for why it should be used more widely.
He began with the motivation for his presentation, which was netstack3, Fuchsia's new networking stack written entirely in Rust. The project started six years ago, and Liebow-Feeser led the project for four years. Networking stacks are ""very serious"", he said. They are responsible for almost all traffic, often implement dozens of different protocols, and are the first line of defense against attackers. They're also just plain large pieces of software.
Netstack3 encompasses 63 crates and 60 developer-years of code. It contains more code than the top ten crates on crates.io combined. Over the last year, the code has finally become ready to deploy. But deploying it to production requires care — networking code can be hard to test, and the developers have to assume it has bugs. For the past eleven months, they have been running the new networking stack on 60 devices, full time. In that time, Liebow-Feeser said, most code would have been expected to show ""mountains of bugs"". Netstack3 had only three; he attributed that low number to the team's approach of encoding as many important invariants in the type system as possible.