[OT] NSA guidance on software security

[Siarhei Siamashka]

On Friday, 11 November 2022 at 08:52:46 UTC, Sergey wrote:
> I think it could satisfy the broad definition of MSL:

Yes, NSA could list D language provisionally. But there are still 
many unresolved memory safety issues in D ecosystem in practice. 
Many dub packages and even Phobos are not compatible with @safe 
yet. A very simple example:

```D
@safe:
import std.stdio;
void main() { readln; }
```

```
$ dmd test.d
test.d(3): Error: `@safe` function `D main` cannot call `@system` 
function `std.stdio.readln!string.readln`
/usr/lib/dmd/2.099/import/std/stdio.d(4566): 
`std.stdio.readln!string.readln` is declared here
```

Without actual @safe annotations already in place, a lot of the 
existing D code is not really safe. It's surely safer than C/C++, 
but this not good enough to convince those who are in charge of 
making programming language choice decisions in companies.

Just imagine that somebody is responsible for buying, let's say, 
parachutes to replace their existing notoriously unreliable 
brand. Given a choice between cheaper/convenient (similar to D) 
and more reliable (similar to Rust) parachute types, what will 
this person decide to buy for his team? Keep in mind that any 
future fatal accidents will be surely blamed on this person in 
the case if he decides in favor of a cheaper option...

TL;DR; You can't really sell a half baked safety nowadays.