Why C instead of Rust if you're using AI anyway?

C introduces the possibility of memory-safety issues, which are deadly in server software that's exposed to the Internet. And AI, from what I've seen, is not all that great at writing software with zero memory bugs.

Rust closes the memory safety holes, at the cost of making the programmer think through ownership and architecture much more carefully. Those are exactly the skills that AI is good at. So if you want something fast and are writing it with AI anyway, why not have the AI generate Rust code?

▲

joshheitzman an hour ago | parent | next [-]

Because the memory safety Rust offers isn't worth the supply chain risks: https://safeguard.sh/resources/blog/rust-supply-chain-securi...

▲

zanecodes 43 minutes ago | parent | next [-]

A problem that C solves by simply not having a supply chain! You can vendor dependencies in Rust just as easily as you can in C; far easier in fact thanks to `cargo vendor`. Cargo won't review them for vulnerabilities though, you'll still have to do that yourself.

	▲	1718627440 32 minutes ago \| parent \| next [-]
		It does, the package systems of C evolved alongside the OS, so they are now the OS package managers and also cope with all other language mangers.
	▲	Ygg2 31 minutes ago \| parent \| prev [-]
		C (and C++) has a supply chain. It's called unpaid Linux maintainers.

▲

nostrademons 41 minutes ago | parent | prev | next [-]

Don't use packages you didn't vibecode and audit yourself then. That's the situation C puts you in anyway.

	▲	joshheitzman a minute ago \| parent [-]
		The Rust ecosystem isn't structured for the high friction dependency model the C has. Its structured around nearly frictionless dependencies so its no surprise that dependency trees are very large and frequently changing. The typical C project has far fewer dependencies than the typical Rust project. Those dependencies are usually individually larger and either maintained by OS maintainers or there is a copy of the code that is built for the project and is readily available for audit. Those copies can't change without direct action. Its less trouble to setup static analysis, address sanitizer, and similar tools for a C project than it would be to manage local copies of thousands of dependencies for a Rust project.

▲

an hour ago | parent | prev [-]

[deleted]

▲

cozzyd an hour ago | parent | prev [-]

supply chain, compile times, binary size

	▲	nostrademons 42 minutes ago \| parent [-]
		Not huge problems for a web app, where you are controlling deployment yourself.