Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Rust in Android: More Memory Safety, Fewer Revisions, Fewer Rollbacks,
Shorter Reviews

Link: https://developers.slashdot.org/story/25/11/1...

Android's security team published a blog post this week about their
experience using Rust. Its title? "Move fast and fix things." Last year, we
wrote about why a memory safety strategy that focuses on vulnerability
prevention in new code quickly yields durable and compounding gains. This
year we look at how this approach isn't just fixing things, but helping us
move faster. The 2025 data continues to validate the approach, with memory
safety vulnerabilities falling below 20% of total vulnerabilities for the
first time. We adopted Rust for its security and are seeing a 1000x reduction
in memory safety vulnerability density compared to Android's C and C++ code.
But the biggest surprise was Rust's impact on software delivery. With Rust
changes having a 4x lower rollback rate and spending 25% less time in code
review, the safer path is now also the faster one... Data shows that Rust
code requires fewer revisions. This trend has been consistent since 2023.
Rust changes of a similar size need about 20% fewer revisions than their C++
counterparts... In a self-reported survey from 2022, Google software
engineers reported that Rust is both easier to review and more likely to be
correct. The hard data on rollback rates and review times validates those
impressions. Historically, security improvements often came at a cost. More
security meant more process, slower performance, or delayed features, forcing
trade-offs between security and other product goals. The shift to Rust is
different: we are significantly improving security and key development
efficiency and product stability metrics. With Rust support now mature for
building Android system services and libraries, we are focused on bringing
its security and productivity advantages elsewhere. Android's 6.12 Linux
kernel is our first kernel with Rust support enabled and our first production
Rust driver. More exciting projects are underway, such as our ongoing
collaboration with Arm and Collabora on a Rust-based kernel-mode GPU driver.
[They've also been deploying Rust in firmware for years, and Rust "is
ensuring memory safety from the ground up in several security-critical Google
applications," including Chromium's parsers for PNG, JSON, and web fonts.]
2025 was the first year more lines of Rust code were added to Android than
lines of C++ code...

Read more of this story at Slashdot.

---
VRSS v2.1.180528