一句话：一项大规模实证研究揭示 Unsafe Rust 的使用比例及不安全性的传播，质疑 Rust 的内存安全承诺。
Rust 以强类型系统承诺内存安全与无数据竞争，但内嵌的 Unsafe Rust 允许 C 风格指针、可变全局变量等难以静态检查的操作，使用时编译器无法静态保证安全。本文对真实 Rust 库与应用开展大规模实证研究，考察开发者如何使用 Unsafe Rust。结果显示，不到 30% 的库直接使用 unsafe 关键字，但超过半数因调用链中隐藏的 Unsafe Rust 而无法被编译器完全静态检查。作者认为，unsafe 使用虽有限，不安全性的传播却挑战了 Rust 的内存安全宣称，并建议改进编译器和中心仓库接口以提醒开发者代码何时不安全。
Rust, an emerging programming language with explosive growth, provides a robust type system that enables programmers to write memory-safe and data-race free code. To allow access to a machine's hardware and to support low-level performance optimizations, a second language, Unsafe Rust, is embedded in Rust. It contains support for operations that are difficult to statically check, such as C-style pointers for access to arbitrary memory locations and mutable global variables. When a program uses these features, the compiler is unable to statically guarantee the safety properties Rust promotes. In this work, we perform a large-scale empirical study to explore how software developers are using Unsafe Rust in real-world Rust libraries and applications. Our results indicate that software engineers use the keyword unsafe in less than 30% of Rust libraries, but more than half cannot be entirely statically checked by the Rust compiler because of Unsafe Rust hidden somewhere in a library's call chain. We conclude that although the use of the keyword unsafe is limited, the propagation of unsafeness offers a challenge to the claim of Rust as a memory-safe language. Furthermore, we recommend changes to the Rust compiler and to the central Rust repository's interface to help Rust software developers be aware of when their Rust code is unsafe.