►
From YouTube: RustFest Barcelona - Sebastian Fernandez & Ryan Levick: R-Evolution: A Story of Rust Adoption
Description
The software industry has a billion dollar problem. Our underlying systems are built on a mountain of insecure technologies that make it next to impossible to write secure software. There are an innumerable amount of cases where Rust could have prevented serious security issues that not only had a deep impact on companies but more importantly on people.
But the path to wider adoption of Rust across industry is filled with many challenges not only for companies but for the Rust community itself. What does this journey to industry-wide adoption look like? How can we all work together to make sure that as more companies start adopting Rust, the language gets even better?
https://barcelona.rustfest.eu/sessions/r-evolution
A
Very
often
we
are
a
company
that
normally
invents
programming
languages
and
if
we
do
it's
usually
in
the
order
of
one
per
decade,
that
sees
the
light
of
day
and
so
bringing
in
a
new
programming
language
is
something
that
doesn't
happen
every
few
months,
but
really
every
ten
years
or
so.
So
this
is
a
very
exciting
time
for
us,
but
before
we
get
started
talking
about
that
real
quick,
a
little
bit
about
ourselves,
my
name
is
Ryan.
You
can
find
me
on
twitter
at
a
Trion
underscore
Loic,
say
hello.
A
I've
been
riding
rust
for
quite
some
time
now
before
I
joined
Microsoft
before
1.0
came
out
and
I
was
the
MC,
the
very
first
press
fest.
So
it
is
extremely
exciting
to
see
so
many
people
here
we're
excited
about
rust
back
in
the
day
used
to
be
I
would
mention
that
I,
like
trust
and
people,
would
go
what's
rust
and
that's
happening
a
lot
less
often
now,
which
is
really
really
cool.
B
Hola
Barcelona
and
my
name
is
Sebastien
I'm
in
security
software
engineer
it
means
that
I
work
with
when
it
ability
some
patching
software,
those
kind
of
things
and
I'm.
We
know
so
right
in
rut,
or
six
years
now,
I
actually
checked
yesterday
or
how
long
I've
been
writing.
Rust
and
I
I
found
that
my
first
contribution
to
the
ROK
compiler
was
in
2013
and
it
was
a
tiny
but
four
lines,
but
it
was
a
best
way
of
blaming
rust
for
me,
so
yeah
yeah
yeah.
We
both
work
for
Microsoft,
opposite
sides
of
Microsoft.
B
B
A
So
we're
gonna
be
talking
about
adoption
of
Russ
today
at
Microsoft,
but
before
we
get
big
before
we
begin
with
that.
The
first
thing
to
talk
about
is
the
problem
that
we're
actually
trying
to
solve.
Obviously,
when
we
don't
want
to
adopt
a
programming
language
just
because
it's
cool
just
because
we
too
like
to
write
it
as
much
as
I
wish
that
were
possible,
you
don't
get
very
far
with
that
kind
of
reasoning,
and
so
we're
really
trying
to
address
a
problem
here,
and
this
isn't
really
a
problem
that
affects
us
as
a
company.
Only.
A
It's
also
a
problem
that
we
believe
it
impacts
the
entire
industry,
the
entire
software
industry
and
because
of
this
situation,
we've
gotten
ourselves
into
as
the
software
industry.
That
really
impacts
the
entire
world
for
better
or
for
worse-
and
this
is-
we
should
say-
a
billion
dollar
problem
really
impacts
us
in
an
extremely
deep
way
and
I
know.
Money
is
perhaps
not
the
best
way
to
measure
this,
but
you
can
think
of
it
not
only
as
a
problem
that
causes
us
to
lose
money,
but
also
causes
everybody
in
this
room.
A
Everybody
in
the
world
really
a
lot
of
headache
and
pain
and
at
the
core
of
this
problem
at
the
very
very
core
of
this
problem
is
a
technology
that
we've
been
using
in
the
software
industry.
That
has
gotten
us
very
very
far
and
been
really
really
great
at
a
lot
of,
but
is
really
starting
to
show
for
lack
of
a
better
word
its
age
and
that
technology
is
C
and
C++.
C
and
C++
are
extremely
great
at
writing
low-level
systems.
They
use
very
little
resources
on
the
machine.
B
So
I'd
like
to
introduce
a
little
about
and
what
the
Security
Response
Center
does
and
the
Security
Response
Center
is
basically
an
organization
in
Microsoft
centralizes,
the
management
of
vulnerabilities.
It
means
that
we
work
with
external
researchers,
internal
researchers
as
well
to
find
vulnerabilities
in
the
Microsoft
product.
B
B
B
Well,
this
is
a
very
conservative
estimate,
and
this
is
one
hundred
and
fifty
thousand
dollars
per
issue.
You
can
see
this
it's
a
lot
of
money,
and
this
is
only
for
Microsoft.
It's
not
accounting
for
the
work
and
time
that
our
customers
have
to
spend.
Rebooting
machines
is
telling
the
parties
and
doing
everything
else
that
every
Tuesday.
A
B
Only
in
2018
we
had
four
hundred
sixty-eight
issues.
You
can
see
that
this
is
a
lot
of
money
if
you
made
Emma,
if
you
made
a
if
you
made
a
Matthew
and
x
times
the
amount
of
money
with
Perisher
yeah.
This
is
this
is
a
lot
and
we
can
see
the
the
the
issue
is
not
getting
any
better.
It's
actually
getting
worse
year
over
year,
and
only
in
2019
we
had
over
170
issues
and
Annie.
There
is
not
even
over
yet
sorry
about
the
meek.
A
B
This
this
cost
is
only
for
for
when
the
good
people
find
the
issues
they
reported
to
us,
then
we
patch
them
and
then
everyone
is
happy,
but
what,
if
my
world
also
finds
the
bug
and
write
an
expiry
for
it?
This
has
happened
like
many
many
times
in
history,
but
there
are
a
few
occasions
that
we've
got
out
of
hands.
B
That
was
exploiting
also
us
to
your
surprise,
buffer
overflow,
in
one
of
the
RPC
servers
of
Windows,
in
fact
in
the
machine
and
then
also
using
the
machine
to
distribute
the
virus
to
the
other
machines
and
most
most
recently
and
when
I
cry
I
know
if
you
were
affected
by
it
of
your
organization,
but
you
probably
know
more
than
one
person
that
was
affected
by
it.
What
is
one
was
doing
was
exploiting
and
the
SMB
server
off
of
Windows
then
was
infecting
the
machine
and
crypt
in
all
the
day.
B
A
Alright,
so
we
have
these
memory
safety
vulnerabilities
that
are
causing
lots
of
head
ache
and
pain
upwards
of
four
billion
dollars
at
a
time.
That's
really
not
a
good
thing,
but
how
could
we
actually
fix
this
issue
and
there's
been
many
ideas
that
have
occurred
over
the
years,
some
better
than
others,
and
we're
going
to
talk
about
a
few
of
them,
so
the
first
bright
idea
that
was
had
and
there's
an
idea
that
you
often
see
on
a
particular
orange
website
nowadays
is
that
we
need
better
programmers,
all
right,
we're
done.
A
Thank
you
know
this.
Please
stop!
This
does
not
work.
We
need
better.
Programmers
is
not
an
answer
to
this
training
does
help.
You
can
try
to
mitigate
some
issues
by
making
people
better
at
writing.
Secure
software.
So
we're
not
saying
that
you
should
not
train
people,
but
this
is
absolutely
by
no
means
a
way
to
address
this
issue.
You
can
have
extremely
highly
talented,
highly
trained
individuals
writing
code
and
they
will
still
make
mistakes
so
no
now
that's
that
is
out
of
the
way.
That's
good.
A
A
But
these
tools
are
not
perfect
and
we
are
convinced
that
they
can
never
be
perfect.
So,
there's
really
only
one
idea
left
that
we
can
actually
use,
and
this
is
really
the
only
way
that
we
can
address
this
issue
fully
and
that's
the
idea
that
we
need
to
make
these
issues
impossible
to
introduce
in
the
first
place
and
over
time
there
have
been.
There's
actually
been
a
lot
of
active
research
into
this
area.
A
B
So
I
think
to
understand
the
issue.
We
have
to
understand
the
role
we
have
to
understand
the
program
to
find
a
solution,
so
we
can
classify
the
memory
safety
vulnerabilities
in
into
big
classes
of
vulnerabilities
and
one
is
related
to
spatial
memory
safety.
What
does
it
mean
that
when
you
have
a
pointer
or
a
buffer,
that
that's
some
type
of
memory
and
it
usually
has
a
size-
it's
not
infinite.
B
So
when
you
try
to
index
out
of
that
buffer
or
pointer
and
you
go
to
C
developers
called
undefined
behavior,
so
it
means
that
everything
is
wrong
and
it's
not
doing
what
you
are
expecting
it
to
do.
For
fixing
this
issue.
There
is
a
clear
way
that
most
languages
are
half
now
that
runtime
check.
When
you
allocate
memory
you
subscribe,
you
can
embed
that
information
is
in
the
pointer
in
the
buffer.
So
now
you
have
rich
pointer
or
fat
pointer.
B
So
when
you
try
to
index
that
pointer
now,
you
have
a
random
check
that
you
don't
have
to
do
anything.
If
is
the
indices
outside
the
bounds
it?
It
will
fail.
The
the
memory,
access
and
nothing
bad
will
happen
and
the
second
type
of
say
the
memory
safety.
We
can
talk
about
this
and
spatial
memory
safety.
This.
This
means
that
when
you
claim
memory
or
when
you
allocate
memory
that
memory
will
be
valid
only
for
some
time
once
it
gets
freed,
you
shoot
them.
B
You
shouldn't
be
using
that
memory,
but
sometimes
in
the
languages
you
don't
clear
the
references
and
then
you
can
still
access
it,
and
there
is
an
easy
way
of
solving
des
that
a
lot
of
languages
use
that's
an
using
garbage
collection.
What
does
it
mean
that
you
can
clean
memory?
But
you
cannot
free
memory
manually.
You
expect
the
runtime
to
frida
memory,
and
this
is
basically
always
leaving
the
memory
they
are.
And
then
you
will
have
these
program
inside
the
runtime
that
will
go
and
find
the
memory.
That's
not
used
anymore
and
free.
A
A
So
if
you're
writing
an
operating
system
or
perhaps
a
really
low
level
system
like
the
database
or
something
like
that,
more
often
than
not,
you
don't
want
to
pay
the
penalty
of
having
a
garbage
collection
there
collector,
which
comes
with
performance
penalties
and
also
comes
with
penalties
for
not
really
knowing
when
certain
things
will
run
and
that's
just
oftentimes
unacceptable,
but
we
believe
that
there
is
a
technology
out
there
that
allows
us
to
kind
of
have
our
cake
and
eat
it
too,
and
spoiler
alert.
It's
rust.
A
B
I
mean
right:
I
was
talking
before
about
making
these
issues
impossible
and
that's
kind
of
a
hard
thing,
and
but
what
if
we
could
isolate
what
unsafe
from
not
unsafe,
what's
unsafe
from
safe,
and
when
we
are
looking
at
the
C++
code
base,
we
find
that
hundred
percent
of
the
code
base
is
written
in
unsafe
super
bad.
You
have
no
way
of
isolating
what
what's
safe
from
and
safe.
B
For
example,
we
are
talking
about
software.
We
have
to
pull
to
make
thread
models
about
the
software.
What
does
it
mean
that
you
have
to
make
an
analysis
of
how
the
software
can
be
attacked?
If
we
are
talking
about
a
browser,
for
example,
a
browser,
the
thread
model
is
that
every
website
can
be
malicious.
B
If
we
are
talking
about
the
kernel,
we
have
to
start
from
the
ground
that
each
program
user
running
in
user
space
will
be
also
malicious,
so
that
has
to
protect
it
has
to
protect
from
every
program
and
after
you
have
this
suite
model.
For
these
two
examples,
you
come
to
the
conclusion
that
almost
all
this
all
the
code
is
exposed
to
the
to
their
malicious
symbols.
B
Remember
I
was
wroth
kampf
watching
and
sharing
means
Jeremy's
talk,
and
he
was
talking
about
the
rest
adoption
in
Facebook
and
he
was
saying
that
the
recessed
ratio
of
data
technology
technology
has
to
overcome
to
be
10
times
better
and
done
than
the
next
technology
available.
And
we
can
see
here
Rusted
not
over
that
threshold.
But
we
can
consider
out
in
this
aspect
it's
a
hundred
times
better
than
the
next
technology
available.
A
But
of
course,
we're
a
truss
fests,
so
we're
kind
of
preaching
to
the
choir
here,
most
mostly
everybody
in
this
room
probably
already
understands
this.
You
may
not
have
selected
to
use
Russ
or
this
property,
but
you've
probably
heard
about
it
before,
and
so,
let's
just
say
for
the
sake
of
argument
that
we're
going
to
use
rust,
we
we
have
chosen
it.
We've
been
able
to
convince
ourselves
that
this
is
a
good
thing
to
adopt.
A
It's
going
to
be
a
very,
very,
very,
very,
very
long
time
until
that
goes
away,
even
if
we
were
all
100%
convinced
that
that's
the
right
thing
to
do
so
when
we
talk
about
rust
adoption,
the
first
thing
that
we
should
take
a
step
back
at
and
look
at
is
actually
how
do
languages
get
adopted,
and
particularly,
how
do
they
get
adopted
in
existing
large
companies?
Because
if
it's
a
start-up,
it's
quite
easy.
A
You
can
just
choose
to
use
a
new
technology
because
you
haven't
written
any
code
before,
but
if
you
haven't
a
huge
code
base
that
already
has
seen
C++
in
it.
What
is
the
process
actually
like,
and
the
issue
with
this
is
the
following:
you
have
costs
and
you
have
benefits
and
I,
don't
know
if
you
can
see
it,
but
down
there,
it
says
benefits
but
they're
very
hard
to
see
the
costs
are
quite
clear.
A
You
have
the
costs
of
actually
introducing
the
code
inside
of
your
code
base
of
introducing
the
compiler
inside
of
of
your
build
system.
These
are
all
very
clear
costs
and
are
actually
very
easy
to
reason
about
how
much
it
will
and
end
up
costing
your
organization
to
actually
adopt
it.
But
the
benefits
of
introducing
a
new
language
may
not
be
so
clear
if
you're
introducing
a
new
language,
because
it
has
a
great
type
system
and
you
think
that
that
type
system
will
not
introduce
as
many
bugs
as
the
current
language
you're
using
well.
A
How
do
you
actually
prove
that
it's
extremely
difficult
to
actually
measure
the
impact
of
something
like
a
more
advanced
type
system,
but
at
the
end
of
the
day,
this
is
what
makes
rusts
more
adoptable
because
for
rust,
that
picture
looks
more
like
this,
where
the
costs
are
still
quite
clear,
but
at
least
this
one
benefit
that
we've
been
talking
about
of
memory.
Safety
is
extremely
clear.
A
We
know
that
rust
will
get
us
much
further
along
to
the
writing
memory
safe
code,
and
we
know
that
memory
unsafe
code
leads
to
billions
and
billions
and
billions
of
dollars
of
damage.
So
it's
quite
easy
to
go
to
people
and
say
how
about
we
stop
spending
billions
of
dollars
on
this
stuff
and
they
go
sounds
good
and
of
course,
I've.
A
We've
only
written
benefit
here,
that's
not
to
say
that
rust
doesn't
have
other
benefits,
it's
just
to
say
that
those
are
harder
to
talk
about
and
harder
to
convince
others
in
a
large
organization
to
bet
on
rust
because
of
them
so
really
when
it
comes
to
adopting
it
in
a
large
organization.
It
really
is
enough
to
just
talk
about
its
memory
safety
properties
in
order
to
convince
others
that
is
worth
adopting.
B
B
B
This
means
that
we
have
to
integrate
rust
with
with
our
infrastructure
and
that's
not
easy,
because
rust
is
not
just
a
language.
Rust
is
a
set
of
tools
that
you
are
bringing
to
your
infrastructure
and
this
especially
for
for
Windows
people
and
rust,
comes
with
this
beast
that
the
compiler
back
in
that
rust
uses
that
is
LLVM
and
VM,
has
topped
it
with
great
support
for
much
BSD
than
Linux.
But
Windows
support
is
not
really
there
and
we.
B
Continuing
on
this
line
of
bringing
all
the
all
these
rust
tools
to
your
infrastructure
is
that
we
have
a
lot
of
tools
that
we
have
to
run
in
our
pipelines
to
generate
the
binaries
and
to
check
that
the
binaries
are
okay.
If
an
example
is
that
we
check
all
our
all,
the
binaries
I
will
ship
to
our
customers
and
for
for
performance.
That
means
analyzing
all
the
binaries
in
at
runtime
checking
that
they
are
doing
well
and
sometimes
rewriting
those
minor
is.
B
To
analyze
binaries
produced
by
ms
PC
and
it
obviously,
you
cannot
just
expect
that
LLVM
enemies,
you
see
are
generating
the
same
type
of
binaries.
They
have
different
name
mangling,
they
have
different
types
of
symbols
and
the
arranged
information
in
the
riff
way
and
they
have
different
heuristics
for
generating
the
code.
So
this
is
a
whole
new
set
of
tools
that
we
have
to
adopt
and
continuing
on
this
line
of
tooling.
B
We
have
also
build
system
that
have
been
optimized
for
many
many
years
to
perform
well
and
to
comply
with
a
set
of
rules,
as
we
have
our
business
and
just
shut
for
a
second
in
machine
and
theoretically,
that
you
want
to
include
a
rot
component
inside
Windows,
and
these
challenges
are
that
when
you,
when
you
want
to
use
Roscoe
there-
and
you
have
obviously
cargo
which
people
used
to
build
and
to
build
rust,
binaries
and
cargo
is
a
great
tool.
I
mean
who
can
imagine
using
rust
without
using
cargo.
B
You
are
losing
half
of
the
half
of
the
features.
Cargo
is
a
great
will,
build
tool
and
a
great
package
management
tool,
but
it
has
to
be
integrated
in
a
in
an
existing
the
system.
We
cannot
just
let
cargo
manage
our
whole
bin
system
and
obviously
for
cargo.
There
is
rust
code
and
not
rust
code.
That
is
nothing
else
for
for
cargo
and
convene
on
this
line.
We
have
a.
B
Fortunately,
it's
very
good
at
interoperating
with
other
technologies,
because
it
supports
most
of
the
ABI,
is
supported
by
C,
also
another
great
tool
that
comes
with
rust.
It
banshan
mention,
lest
you,
take
a
seat
header
and
generated
rot
binding
for
it,
but
the
downside
is
you
have
now
all
these
unsafe
binding
that
you
have
to
make
a
save
wrapper
around
it.
So
maybe
the
idea
is
that
in
the
future
we
can
kind
of
guess.
B
If
we
can,
if
we
can
make
a
safe
wrapper
around
these
C
headers
and
the
last
one,
is
the
it's
crazy
but-
and
there
have
been
like
many
technologies
to
make
interoperability
language
agnostic.
This
labor
is
like
common
and
we
have
T.
These
are
well
define
an
API
standards,
because
what
severity
then
have
a
well-defined
ABI
e
back
then-
and
these
are
things
that
the
communicative
working
on
we
analyze
most
of
these
most
of
the
things
available
for
calm,
and
we
decided
to
to
also
write
another
an
hour
comradery
that
we
released
this.
B
A
B
We
are
getting
there
with
interoperability,
then
we
have
also.
We
have
problems
that
common
people
don't
have
and
what
sorry
common
people
is
about
description
body
and
individual
developers,
maybe
don't
don't
have
or
a
small
companies
but
the
company's
food
processes
in
place
to
prevent
errors
from
from
happening.
It
means
that
everything
that
you
bring
into
the
company
have
to
must
must
comply
with
a
set
of
rules,
and
one
of
them
is
having
a
trusted
tool
chain.
B
So
you
seen
rust
up
there
or
putting
the
rat
compiler
directly
into
the
build
system
is
not
an
option.
It
means
that
we
have
to
build
our
own
tools,
and
this
is
a
big
challenge,
because
we
have
to
start
from
a
trusted
source
code
and
a
trusted
binary
and
then
build
the
trusted
binary
that
we
can
use
in
a
wearable
system.
B
The
following
one
is
about.
These
are
all
examples,
and
there
are
many
more
but
having
a.
We
have
binary
security
policies,
all
the
all
the
binaries
that
we
ship
to
our
customers
comply
with
a
set
of
rules
to
make
to
make
them
more
secure.
So,
for
example,
an
only
miner
is
that
our
sheep
have
the
SLR
and
a
few
other
and
memorialization
mitigations
enable
in
them
an
example
of
it
is
a
control
flow
gap
and
control
flow
here
is
something
to
protect
a
control
flow
of
the
program.
B
So
malicious
input
cannot
hijack
it
and
then
well
do
something
that
the
program
was
not
programmed
to
do,
and
this
was
a
mitigation
I
wasn't
available
in
LLVM
yeah.
Now
we
can
happily
say
that
we
in
a
madest
mitigation
and
contributed
it
back
to
LLVM
and
it's
been
in
master
or
I.
Think
since
last
week,
and
we
hope
we
can
enable
it
in
rust
in
in
the
following
months
as
well.
So.
A
B
B
This
is
a
first
period.
You
have
is
convincing
people
of
using
a
new
technology,
and
fortunately,
for
us
and
rot,
is
a
very
adoptable
technology
and
but
when
you
try
to
tell
someone
hey,
maybe
we
should
use
rust
and
because
it's
memory
safe
the
first
thing
that
they
think
is
okay.
We
already
have
seizure
for
that.
Why?
Why
are
you
suggesting
this
and
then
you
have
to
start
explaining
that
Roth
doesn't
have
a
garbage
collector
and
it
doesn't
have
a
runtime
and
it's
more
similar
to
C++
than
than
actually
seizure.
A
And
the
last
point
is
you
have
to
be
able
to
train
people
who
might
be
used
to
writing
C
and
C++
for
5
10
30
40
years
and
be
able
to
get
it
to
show
them
how
to
write
rest
code
that
they
might
not
be
able
or
used
to
writing?
And
the
good
news
about
this
is
that
when
before,
when
we've
introduced
rust
to
seasoned
C++
programmers,
they
generally
are
able
to
get
it
rather
quickly
because
it
kind
of
just
or
malaises
things
that
they
already
have
in
their
head.
A
When
people
are
coming
from
other
backgrounds,
it
might
be
a
little
bit
more
difficult,
but
while
the
learning
curve
is
quite
steep,
generally
people
get
through
it
and
once
they're
through
that
learning
curve,
they're
quite
productive,
which
is
which
is
really
nice
to
see.
But
we've
been
talking
for
a
while
now
about
the
challenges
that
we're
facing
as
a
company
and
okay,
that's
great
we're
going
to
face
these
challenges,
but
there
are
also
challenges
that
we,
as
an
entire
Russ
community,
also
have
to
face
when
Russ
becomes
more
and
more
adopted.
A
A
But
we
want
these
changes
to,
at
the
very
least
not
disturb
anybody
else
who
doesn't
need
them
and
at
the
at
best,
make
sure
that
they
are
actually
helpful
for
everybody
else,
and
so
this
is
extremely
important
and
going
back
to
the
idea
of
community.
We
want
this
design
to
be
again
community
driven
so
just
like
the
RFC
process
has
happened
in
the
past
with
input
from
everybody
in
the
community.
If
they're,
able
and
willing
to
give
it,
we
don't
want
some
backroom
community
design
happening
and
then
hope.
A
A
I
started
writing
Russ
because
I
wanted
to
not
because
I
had
to,
but
in
the
future
there
probably
will
be
people
who
have
to
write
rust
and
they
may
not
want
to
what
does
that
do
to
our
community
as
we
introduce
more
people
into
it,
who
are
kind
of
reluctantly
there
and
the
real
challenge
with
this
is
maintaining
what
I
like
to
call
the
community
spirit
or
the
thing
that
we
already
collectively
have
as
a
community.
The
thing
that,
in
my
opinion,
makes
rust
awesome.
A
Okay,
so
we're
at
the
end
now-
and
this
is
really
where
we
asked
you
to
come
talk
with
us-
come
engage
with
us,
even
if
you
work
for
a
small,
startup
or
you're,
just
a
hobbyist
programmer,
maybe
you're,
not
a
software
programmer
at
all.
You
just
like
to
use
rust
in
your
free
time,
I'm
all
the
way
to
up
to
you're
working
at
a
huge
company
and
have
some
of
the
similar
problems
that
we
have
we'd
love
to
talk
with.