Four Companies Hit the Same Wall. All Four Landed on Rust

[00:00:00]Every 2 minutes on the dot, one of Discord's services stumbled. Not under a traffic spike, under nothing. Requests flat, machines cool, and then a latency jump you could set your watch by. Their engineers spent months on it. Version upgrades, different allocation patterns, it never went away. And the reason it never went away is that it was never a bug. Meanwhile, across town, a company routing a meaningful slice of the entire internet was hitting the same wall from a completely different direction. It would end up running its proxy on a fraction of the hardware it used before.

[00:00:30]What both companies ran into wasn't a defect in their software. It was a decision someone else made years earlier, buried three layers under their code, and they were never allowed to override it. And to understand why that decision only becomes a problem at a certain size, you have to look at the thing it was built to protect you from.

[00:00:47]Garbage collection is one of the best ideas in the history of software engineering. Before it, a whole category of the worst bugs we know how to write, use after free and dangling pointers among them, was just part of the job.

[00:00:59]The collector takes memory management away from you and does it on your behalf. 99% of the software running right now is better for it. The trade is that it has to stop and look. To know what's safe to free, the collector walks your live data and follows every pointer. And while it's doing that, some part of your program isn't running.

[00:01:16]Modern collectors are extremely good at keeping that window tiny. Go and Java have spent decades shrinking pauses down into the sub-millisecond range, doing most of the work concurrently. In an API that answers in 80 milliseconds, a pause you can't measure is a pause that doesn't exist.

[00:01:32]Then scale changes the shape of the problem.

[00:01:34]Discord's read state service isn't a normal service. It's the thing that answers the question, has this user seen this message? And it gets asked on essentially every message for every user in every channel. Hundreds of thousands of cache updates a second, millions of entries held in memory on purpose, because putting them on disk would be slower. A collector that has to walk that many live objects doesn't get to be cheap. There's no version of that scan that's free because the work is proportional to how much you're keeping, and keeping it is the entire point of the service. And Go at the time forced a collection cycle every 2 minutes whether the heap had grown or not. So, the cost wasn't just high, it was scheduled. A slow service you can optimize. A cost that arrives on a timer that scales with the data you deliberately hold and that you can't tune away because it lives in the runtime instead of your code. That isn't a performance problem. That's a ceiling. Now, here's the part most coverage of this skips. None of that makes Go a bad language. Go is a superb language and that same collector is the correct answer for almost every other service running at that company. The trade only turns bad in one very specific corner.

[00:02:38]Enormous live heaps, tail latency that's contractually load bearing on hardware bills big enough that 30% is a line item somebody notices. Almost nobody is in that corner. But the companies that are are the ones holding the internet up.

[00:02:50]Once you know what that ceiling looks like, you start seeing the same silhouette in places that have nothing to do with each other. Discord, 2019.

[00:02:58]The read state service. Go to Rust. When it shipped, average response time moved from milliseconds into microseconds. The 2-minute sawtooth disappeared and the cash scaled past 8 million entries without the curve bending. There is something inside that migration that doesn't match the headline at all and that one gets its own episode.

[00:03:15]Cloudflare, 2022. Pingora, an in-house HTTP proxy written in Rust. Replacing an Nginx and Lua stack that had run their edge for years. Over a trillion requests a day on roughly a third of the CPU and a third of the memory. In May of this year, they pushed it further. The cash moved onto Pingora, too. Microsoft, completely different pressure.

[00:03:37]In 2019, their own security response center published the number that reframed the whole debate. 70% of the CVEs Microsoft had assigned over the previous 12 years were memory safety issues, not logic bugs, memory. Since then, Rust has quietly landed inside Windows itself. A Rust implementation of parts of the graphics kernel ships as win32kbase.rs in 24H2. And a fourth one, just so this doesn't look like three cherry-picked cases. AWS Firecracker, the micro VM monitor sitting underneath Lambda and Fargate. Written in Rust, around 50,000 lines, boots a virtual machine in about 125 milliseconds with under 5 MB of overhead. Just about every serverless function you invoke on AWS today boots inside it. Four companies, four completely different pain points. Tail latency, compute cost, attack surface, isolation overhead. Same answer, arrived at independently by teams that share no code and no incentives. Which raises the obvious question, why is the answer always the same one? The internet's version of this story is that engineers fell in love with a language. That's not what happened. Not one of these four teams went looking for Rust. Every one of them went looking for a way around a wall, and Rust was the only thing standing on the other side of it. The actual mechanism is simpler than the discourse around it. Every language has to answer one question, when this memory is no longer needed, who frees it? There are three answers that matter at infrastructure scale. You free it yourself, and that's C and C++. Maximum control and 70% of Microsoft CVEs.

[00:05:08]Modern C++ gets close to automatic here with smart pointers freeing at known points, but nothing in the compiler forces you to use them or proves you got it right. Second answer, a runtime frees it for you while you wait. That's Go, Java, C#. Safe by default and you pay in pauses you don't control. Or the compiler proves at build time when memory can be freed and emits the free itself. No runtime, no collector, and no dangling pointer either. Rust took the third answer. That's the whole trick.

[00:05:35]Everything downstream, the CPU numbers, the flat tail latency, the memory safety in a kernel driver, falls out of that one decision. If this kind of breakdown is useful, support the channel on Patreon. And the bill for it is real.

[00:05:47]You pay at compile time and you pay inside your engineers heads. The compiler needs you to prove ownership of every value and until that's intuition instead of effort, you will fight it.

[00:05:56]Teams routinely describe months, not weeks. That cost lands on day one. The savings show up in year two. So, the trade only clears when three things are true at once. One, the runtime cost is structural. It scales with your data, not your bugs and no amount of tuning removes it. Two, you're big enough that a double-digit slice of your compute bill is a line an executive actually reads. Three, the component is stable enough to be worth rewriting because nobody rewrites a service whose requirements change every quarter.

[00:06:24]Discord had all three. Cloudflare had all three. Firecracker was greenfield at the isolation layer, which is the fourth version of the same situation. Your crud service has none of them and rewriting it in Rust would be a slow, expensive way to arrive exactly where you already are. Which brings us to the uncomfortable half of the story. If you only read the headlines, you'd walk away with something that isn't true. And the distortion runs in both directions. In one direction, the coverage undersells it. There are migrations here where the most interesting decision in the whole project barely involves the language and the blog post that made the rounds never quite says so. The number in the headline is correct. The explanation attached to it is doing a lot of quiet work. In the other direction, and this is the one that got genuinely out of hand. Late in 2025, a Microsoft distinguished engineer wrote publicly about eliminating every line of C and C++ from the company by 2030 with AI assistance. Within days, it had been rewritten across the industry as Microsoft is rewriting Windows in Rust using AI. He posted a clarification.

[00:07:24]What it actually said is the part nobody picked up. The correction traveled a fraction as far as the claim. It usually does and the sharpest complication comes from inside the Rust camp itself. That Windows graphics component, the Rust one, shipped with a vulnerability.

[00:07:38]Independent researchers fuzzed metafile handling, found an out-of-bounds array access, and crashed the kernel with it.

[00:07:44]Microsoft patched it. Read what that actually is though. In safe Rust, an out of bounds access doesn't corrupt anything. It panics. The check fired, the memory stayed intact, and the attacker got nothing readable out of it.

[00:07:57]What memory safety bought there was zero corruption. What it did not buy was availability. And in a kernel, a panic takes the whole machine down with it.

[00:08:04]Zero corruption is an enormous win. It is not the same win as staying up. And the class of bug it eliminates really is enormous. Remember that 70% again, the one from Microsoft's own CVE history.

[00:08:16]Google's numbers on Android are the cleanest evidence anyone has produced that the number moves. Memory safety issues fell from 76% of Android vulnerabilities in 2019 to about 24% in 2024. The raw count dropped from 223 to under 50. That's a security posture visibly changing shape over 5 years. But fewer of one category is a different sentence from safe. And any video that tells you otherwise is selling you something. So the honest version of this story is less dramatic than the headline and more interesting than the hype. It isn't a takeover and it isn't sudden. It started in 2019 with one team, one service, and one problem they couldn't tune away. It's been running quietly ever since, one component at a time, at the specific companies where the trade actually clears. And it's still a rounding error against the amount of Go and Java and C# in production, which is exactly where most of it belongs. What's actually happening is narrower and stranger than everyone is switching. A handful of companies, all of them operating at a scale you and I will never touch, hit a ceiling that was designed into their tools and chose to pay a very steep upfront price to get out from under it. That's a structural pressure and it only points one direction. I'm taking each of these three cases apart on its own with the exact figures and in at least one of them, an official denial almost nobody covered. Firecracker doesn't get its own episode. It's the control case. The one that proves this isn't three cherry-picked companies telling the same story to make a point. We start with Cloudflare, the proxy that handles a trillion requests a day in Rust and just took over its cache as well. After that, Discord, the two-minute bug and the part of that migration the blog post buried.

[00:09:50]Then Microsoft, where the story is less about Rust than about who gets to write the headline.