The Languages and the Machine
Memory safety went from a preference to a federal position in about three years. Here is the argument, the hardware underneath it, and how the choice gets made in practice.
7 articles · about 67 min in total
Start with Memory-Safe-by-Default: The US Federal Push and What It Does to Your StackMemory safety moved from a language preference to a stated government position in about three years. That is an unusually fast shift for something as slow-moving as programming language policy, and it happened because the vulnerability data stopped being arguable.
The argument itself is narrower than the noise around it. A large share of severe vulnerabilities in large C and C++ codebases are memory safety issues, and those classes are eliminated by construction in a language that checks. That is a claim about categories of bug, not about which language is nicer to write.
Underneath the language question is a hardware one. Arm and x86 are different bargains about instruction complexity and power, and the practical consequence for most engineers is not performance but portability: your container now has to run on both.
The path ends in practice rather than principle. Rust against Go for a backend, Python in a modern deployment, and serverless as the case where you gave the runtime choice away entirely. The last one is worth reading carefully, because that trade is priced very differently at scale than at prototype size.
Key takeaways
- A large share of severe vulnerabilities in large C and C++ codebases are memory safety defects, which are eliminated by construction in a checked language.
- Rust and Go solve different problems: Rust removes a class of bug at the cost of compile-time complexity, and Go optimizes for fast onboarding and predictable concurrency.
- Arm and x86 differ in instruction complexity and power efficiency, and the practical impact on most teams is multi-architecture builds rather than raw performance.
- Serverless trades runtime control for elasticity, and the economics invert at sustained high utilization where a reserved instance is cheaper.
Step 1: Memory-Safe-by-Default: The US Federal Push and What It Does to Your Stack
The feds picked a side. As of January 1, 2026, CISA and the FBI call shipping a C or C++ product without a published memory-safety roadmap a documented bad practice that elevates risk to national security. If you're writing new C++ in 2026, you're fighting the tide.
May 29, 2026 · 11 min read
Step 2: Rust Adoption Stalled: What It Means and What I'd Bet On Instead
Rust just cracked the TIOBE top 10 and has been the most admired language for nine straight years. But only about 26% of Rust users write it professionally, and there were roughly 606 open Rust jobs globally in early 2026. The loudest language is not the winning one. Here's the honest read on where it actually lands.
Jun 2, 2026 · 11 min read
Step 3: Rust vs Go: How to Choose Your Next Backend
A pragmatic, opinionated framework for choosing between Rust and Go, with honest takes on performance, hiring, ecosystem maturity, and the workloads where each actually wins.
Jan 30, 2026 · 8 min read
Step 4: ARM vs x86: What the Chip Architecture War Actually Means for You
ARM quietly became the default in the cloud and won the Mac outright, while x86 coasts on 40 years of compatibility. Here is what that means when you pick a laptop or an EC2 instance in 2026.
May 27, 2026 · 8 min read
Step 5: What chmod 755 Actually Means (and Why 777 Isn't the Fix)
755 is not a number. It is nine switches written in shorthand, three for the owner, three for the group, three for everyone else. Learn the 4-2-1 trick once and you stop looking it up. Then learn the part almost nobody knows: most permission denied errors on a file are really about a directory.
Aug 24, 2026 · 9 min read
Step 6: Modern Python Backend Development: FastAPI, Async, and Production Patterns
A production guide to building high-performance Python backends with FastAPI, async SQLAlchemy, Pydantic v2, and modern deployment patterns.
Mar 3, 2026 · 11 min read
Step 7: Serverless Explained: What It Is and When It Costs More
Serverless is a billing model wearing an architecture costume. Once you do the arithmetic on published AWS prices, a Lambda function crosses over and becomes the expensive option at around 7.5 million requests a month. The number that decides it isn't your scale. It's your duty cycle.
Aug 12, 2026 · 9 min read
Frequently asked questions
- Why is there a federal push for memory-safe languages?
- Because vulnerability data consistently shows that a large share of severe defects in large C and C++ codebases are memory safety issues. Those classes are prevented by construction in checked languages, which makes it one of the few security interventions with a measurable category-level effect.
- Should I choose Rust or Go for a new backend?
- Go if team velocity and onboarding matter most, since it is small, opinionated and quick to learn. Rust if you need predictable performance without a garbage collector, or if the code handles untrusted input where memory safety carries real security value.
- What is the practical difference between Arm and x86?
- For most application developers, portability rather than performance. Arm generally offers better performance per watt and now appears throughout cloud and consumer hardware, which means builds and container images have to target both architectures.
- When does serverless cost more than a server?
- At sustained high utilization. Serverless prices elasticity, so it is cheap when traffic is spiky or low and expensive when a function runs constantly. At that point a reserved instance doing the same work is usually far cheaper.