`@safe` by default. What about `@pure` and `immutable` by default?

[Andrei Alexandrescu]

On 4/15/19 11:59 PM, Mike Franklin wrote:
> I think I may have found a simple migration path to @safe by default.  
> I'm still thinking it through, but if I can justify it, I will write a DIP.
> 
> `@safe` by default is a no-brainer in my opinion, but `pure` and 
> `immutable` by default are less obvious.  With the aforementioned 
> potential DIP, I have an opportunity to correct purity and mutability 
> defaults as well...but is that something we want to do?
> 
> Can anyone save me some trouble and articulate why it would be bad to 
> have `pure` and/or `immutable` by default?
> 
> Thanks,
> Mike

I haven't participated much to this but here's a thought. This migration 
is again in the category "let's change things and evaluate the costs". 
It is so much better to go with "let's add and enjoy the benefits".

It's cheap to make @safe and pure the defaults for a given module. Plant 
this at the beginning:

pure: @safe:

This is easy to enforce via scripting etc.

The problem is there's no opting out of pure. (There's opting out of 
@safe by using @system or @trusted.) So this is where the hammer should go:

pure(false)

We have discussed this on and off perhaps a couple dozen times. I've 
discussed it with Walter a few times and it is clear that some way of 
getting out of pure is sorely needed.

This is what the DIP should be about.