We adopted Rust for its security and are seeing a 1000x reduction in memory safety vulnerability density compared to Android’s C and C++ code. But the biggest surprise was Rust's impact on software delivery. With Rust changes having a 4x lower rollback rate and spending 25% less time in code review, the safer path is now also the faster one.

(Emphasis in original.)

Of course, we should probably take the numbers with a grain of salt here; it's not a controlled scientific experiment, and the estimated vulnerability density for Rust in particular was calculated with a numerator of 1, so it could be way off.

Still, I think it's a good reminder that advocacy for using Rust over C and C++ isn't purely out of some irrational fanboy-ism for the language. The numbers here would have to be extremely off for there not to be a major effect.

Further down in the article:

This near-miss inevitably raises the question: "If Rust can have memory safety vulnerabilities, then what’s the point?"

The point is that the density is drastically lower. So much lower that it represents a major shift in security posture. Based on our near-miss, we can make a conservative estimate. With roughly 5 million lines of Rust in the Android platform and one potential memory safety vulnerability found (and fixed pre-release), our estimated vulnerability density for Rust is 0.2 vuln per 1 million lines (MLOC).

Our historical data for C and C++ shows a density of closer to 1,000 memory safety vulnerabilities per MLOC. Our Rust code is currently tracking at a density orders of magnitude lower: a more than 1000x reduction.

More on Maras blog (2 years old post) and on reddit.

cross-posted from: https://programming.dev/post/40520896

Introducing: Loki! An all-in-one, batteries-included LLM CLI tool

Loki started out as a fork of the fantastic AIChat CLI, where I just wanted to give it first-class MCP server support. It has since evolved into a massive passion project that's a fully-featured tool with its own identity and extensive capabilities! My goal is to make Loki a true "all-in-one" and "batteries-included" LLM tool.

Check out the release notes for a quick overview of everything Loki can do!

What Makes Loki Different From AIChat?

• First-class MCP support, with support for both local and remote servers
  • Agents, roles, and sessions can all use different MCP servers and switching between them will shutdown any unnecessary ones and start the applicable ones
  • MCP sampling is coming next
• Comes with a number of useful agents, functions, roles, and macros that are included out-of-the-box
• Agents, MCP servers, and tools are all managed by Loki now; no need to pull another repository to create and use tools!
  • No need for any more *.txt files
• Improved DevX when creating bash-based tools (agents or functions)
  • No need to have argc installed: Loki handles all the compilation for you!
  • Loki has a --build-tools flag that will build your bash tools so you can run them exactly the same way Loki would
  • Built-in Bash prompting utils to make your bash tools even more user-friendly and flexible
• Built-in vault to securely store secrets so you don't have to store your client API keys in environment variables or plaintext anymore
  • Loki also will inject additional secrets into your agent's tools as environment variables so your agents can also use secrets securely
• Multi-agent support out-of-the-box: You can now create agents that route requests to other agents and use multiple agents together without them trampling all over each other's binaries
• Improved documentation for all the things!
• Simplified directory structure so users can share full Loki directories and configurations without massive amounts of data, or secrets being exposed accidentally

What's Next?

• MCP sampling support, so that MCP servers can send back queries for the LLM to respond to LLM requests. Essentially, think of it like letting the MCP server and LLM talk to each other to answer your query
• Give Loki a TUI mode to allow it to operate like claude-code, gemini-cli, codex, and continue. The objective being that Loki can function exactly like all those other CLIs or even delegate to them when the problem demands it. No more needing to install a bunch of different CLIs to switch between!
• Integrate with LSP-AI so you can use Loki from inside your IDEs! Let Loki perform function calls, utilize agents, roles, RAGs, and all other features of Loki to help you write code.

Cloudflare announced today they have open-sourced the code to Tokio-Quiche as their async QUIC library that combines their previously-open-sourced Quiche QUIC implementation with Rust's Tokio async runtime

The Rust project announced today the release of Rust 1.91 as the latest update to this popular programming language priding itself on memory safety capabilities.

Most notable with Rust 1.91 is now promoting aarch64-pc-windows-msvc to a Tier-1 platform status. This takes the Windows on ARM support by the Rust programming language to the highest support tier inline with other common operating systems and architectures. Rust 1.91 with Tier-1 for Windows on 64-bit ARM/AArch64 also means pre-built binaries are also available for new releases.

Finally. What was a weekly update took them this time 2 months. The long anticipated Next generation trait solver, that replaces the previous Chalk. Alongside of ton of fixes and changes. Below I just copy the New Features list.

• Commit: 049767e
• Release: 2025-10-27 (v0.3.2658)

New Features

• (first contribution) parse script frontmatter.
• (first contribution) expose addConfiguration API from the Code extension.
• switch from Chalk to the next trait solver.
• support navigation on primitives.
• add all, any and not completions in #[cfg].
• log flycheck stdout and stderr to files.
• add "Generate blanket trait impl" assist.
• add "Flip range expression" assist.
• add "Remove else branches" assist.
• improve fixture support.

Fixes

...

Internal Improvements

...

Typst 0.14 was released. Bringing super cool new features and fixes to typst.

Typst is getting an even better alternative to latex.

Universal graphical transforms, better async python integration, unified text layout, and more.

Going public today is CVE-2025-62518, or better known by the name given by the security researchers involved: TARmageddon. The TARmageddon vulnerability affects the popular async-tar Rust library and its various forks like tokio-tar. In turn TARmageddon impacts the uv Python package manager and other users of this library.

Edera made public today their discovery of a critical boundary-parsing bug in the async-tar Rust library and downstream forks like tokio-tar. TARmageddon is rated as a "high" severity bug and can lead to remote code execution through file overwriting attacks.