"Memory Safety is Merely Table Stakes [...]"
summary
Claims that memory safety alone is insufficient for Rust FFIs and demonstrates a prototype called Omniglot that enforces runtime value validation and a scoped type system to prevent invalid booleans and unsound mutable aliasing. Omniglot modifies Bindgen integration, provides crates and runtimes, and confines libraries with hardware and software isolation (MPK/PMP/SFI). Evaluation shows it beats a process‑sandbox approach (Sandcrust) on libpng decompression by avoiding copying and context switches while preserving Rust’s other invariants.
AI-written summary · about
chapters (8)
- 0:00The case for safe FFI
- 2:54Challenges of composition
- 5:49The cost of unsafe FFI
- 11:24Introducing Omniglot
- 14:42Managing foreign memory
- 19:06Temporal safety constraints
- 21:43Implementation and performance
- 23:48Future work and Q&A
related talks
17mBuilding Bridges: Safe Interactions with Foreign Languages through Omniglot
01h 01mMemory Safety: Rust vs. C
28m"Rust Interop: Memory Safety Across Foreign Function Boundaries"
44mUnsafe Rust
45mBuilding Safe and Secure Systems in Rust
59mWhat's the deal with unsafe Rust?
19mCounterexamples in Safe Rust
30mEnsuring Rust Safety: Strategies for Managing Unsafe Rust