Rust in, C and C++ out

Microsoft advises developers to use Rust programming language in new projects rather than C or C++ because of security and reliability concerns.

Mark Russinovich, the chief technical officer of Microsoft Azure, urged developers to utilize Rust in new projects rather than C or C++. According to Russinovich, Rust is preferable over C and C+ for new projects requiring a non-garbage-collected (non-GC) language. GC engines handle memory management. The Rust project advocates that Rust is not a garbage-collection language, whereas Google's Go is. Rust is preferred over Go by AWS engineers due to the efficiencies it provides without GC.

"It's time to stop beginning any new C/C++ projects and switch to Rust instead for any circumstances that call for a non-GC language. For consistency and security purposes. The sector ought to designate those languages as obsolete, "said Russinovich.

Rust, developed by Mozilla and reached version 1.0 in 2020, is currently utilized by many organizations, including the Android Open Source Project (AOSP), Meta, Amazon Web Services, Microsoft for some components of Windows and Azure, the Linux kernel, and many others.

Engineers like Rust's memory safety guarantees, which lessen the need for manual memory management in programs and, consequently, lower the risk of memory-related security flaws affecting large projects written in memory unsafe C or C++, including Chrome, Android, the Linux kernel, and Windows.

Microsoft hammered this argument in 2019, disclosing that 70% of its updates over the previous 12 years had been patch fixes for memory safety problems, mostly due to Windows being primarily written in C and C++. In 2020, Google's Chrome team added its own analysis, noting that memory management and safety problems accounted for 70% of all significant security flaws in the Chrome codebase. Most of it is written in C++.

Rust is a viable alternative to C and C++, especially for infrastructure projects, embedded software development, systems-level programming, and more — but not everywhere and in all projects.

Rust is undoubtedly progressing and is probably close to entering the Linux kernel. In April 2021, the Linux distribution known as AOSP began using Rust on new code while maintaining its C/C++ code base. AOSP supported calls for Rust to be an option for new code in the Linux kernel during that same month.

Meta recently promoted Rust to primary support status alongside C++ for server-side languages. For infrastructure software, AWS funds Rust development. It has been utilized by Azure engineers to provide cloud-based testing tools for WebAssembly modules in Kubernetes. Contrarily, despite interest in Rust, the Chrome team is committed to C++ for the foreseeable future; they claimed that even converting to Rust would not immediately erase a sizable part of security issues. Memory safety is being added to Chrome's C++ code base instead.