Why are people still inventing new languages?

The full story

The episode's narration, word for word. Numbers link to the sources below; timestamps play that moment.

The question 0:00

Last episode ended on a hint: garbage collection is one way to prevent some memory bugs, but it isn't the only one. Yet between 2006 and 2009, a programmer at Mozilla and a team at Google each started a brand new one: Rust, and Go ^1,2. Go's designers say theirs was one of several new languages that made language design a lively field again ². So why are people still inventing new languages?

Seventy per cent 0:31

In July 2019, Microsoft's security team published a striking number ³. Microsoft gives each security flaw it fixes a public ID number, called a CVE ⁴. About seventy per cent of the CVEs Microsoft fixed each year were memory safety bugs: mistakes in how C and C++ code handles memory ^3,4. That held across thirteen years of figures, from 2006 to 2018 ^5,6.

The same number again 1:02

Google's Chromium browser team counted too ^7,8. Of 912 high or critical security bugs since 2015, around seventy per cent were memory safety problems ⁷. That's roughly 640 bugs, by our calculation ⁷. Half of those were use after free, the episode ten bug where a program uses memory it has already handed back ⁷. Two companies, the same share ^3,7.

Not carelessness 1:33

Why would two expert teams get the same answer? Microsoft said it happened despite intense code review, training and checking tools ⁴. Their conclusion: in the traditional systems languages, memory-safe code is near impossible to write at scale ⁴. The US National Security Agency put it plainly: C and C++ rely heavily on the programmer to perform the needed checks on memory ⁵.

Governments step in 2:03

In November 2022, the NSA recommended using a memory-safe language whenever possible ^5,9. Its examples included C sharp, Go, Java, Ruby, Rust and Swift ⁵. In December 2023, America's cyber defence agency CISA, the NSA and the FBI went further, with their counterparts in Canada, Britain, New Zealand and Australia, where the Australian Signals Directorate signed on ⁶. They urged software makers to publish roadmaps for removing memory bugs ⁶.

Guidance, not law 2:39

In January 2025, CISA and the FBI said new product lines for critical infrastructure should be written in memory-safe languages, with a roadmap for existing products by the end of that year ¹⁰. But it's guidance, not law: the document calls itself non-binding ¹⁰. In June 2025, CISA and the NSA added a practical guide to switching ¹¹.

The gap 3:06

So what does memory safe mean? In Microsoft's words, all memory access is well defined ⁴. Most languages in use today already qualify, thanks to garbage collection, the cleaner from episode eleven ^4,12. But that cleaner costs time while the program runs ^5,13. So the systems underneath, like operating system kernels and networking code, mostly stayed in C and C++ ⁴. That left a gap: memory safety without a garbage collector ³.

A broken lift 3:40

As he later told it, Rust began with a broken lift ¹⁴. In 2006, Graydon Hoare, a programmer at Mozilla, came home to his Vancouver apartment block to find the lift's software had crashed, again ¹⁴. He lived on the twenty-first floor ¹⁴. Climbing the stairs, he thought it was ridiculous that programmers couldn't make a lift that works without crashing ¹⁴. So in his spare time he began designing a new language, named after a group of hardy fungi he called over-engineered for survival ^14,1.

Technology from the past 4:15

In July 2010, Hoare told Mozilla's annual summit he'd been writing a safe systems language for four and a half years, in his spare time, and a small group at Mozilla had got interested ¹. His title slide read: technology from the past, come to save the future from itself ¹. Rust 1.0 arrived in May 2015, with a promise of stability ¹⁵. Since 2021, an independent Rust Foundation has looked after it ¹⁶.

A third way 4:46

Rust's trick is a third way to manage memory ¹². In C, you hand memory back yourself; in Java or Python, a collector does it while the program runs ¹². Rust has ownership rules that the compiler checks before the program ever runs ¹². Break a rule, and the program won't compile ¹². Because the checking is done in advance, none of it slows the program down while it's running ¹².

One key per locker 5:13

Remember episode ten's lockers. In Rust, every value has one owner, like a rented locker with exactly one key ¹². Hand the value to a new name, and the key goes with it, so the old name can't open the locker any more ¹². That's called a move ¹². When the owner's part of the program finishes, the locker is emptied and handed back automatically, so nothing gets handed back twice ¹². Where the picture breaks: there's no attendant at the door; the rules are checked before the program runs ¹².

The compiler says no 5:46

Here's the Rust book's own example ¹². It makes a piece of text called s1, moves it to s2, then tries to print s1 ¹². Rust isn't installed on this computer, so this one is quoted from the book, not run here ^12,17. The compiler refuses: borrow of moved value ¹². It points at the line where the value moved, and the line that used it afterwards, then suggests a fix: make a copy, if the cost is acceptable ¹².

Rust in the wild 6:17

In 2017, Mozilla used it to rewrite the part of Firefox that works out how web pages should look ^14,18. The Linux kernel now supports Rust alongside its C ¹⁹. And in 2019, Microsoft's own security team called Rust one of the most promising of the newer systems languages ³.

Borrowing, and an escape hatch 6:37

You can also lend a value without giving it away, which Rust calls borrowing ²⁰. At any moment, either one part of the program may change it, or any number may read it, but never both ²⁰. And a borrowed reference must always be valid, so episode ten's use after free is rejected before the program runs ²⁰. The checker can be over-cautious, rejecting code that would have been fine ²¹. For that, Rust has an unsafe keyword that unlocks a few extra powers, while the other checks stay on ²¹.

A whiteboard at Google 7:11

Meanwhile at Google, on the twenty-first of September 2007, three engineers started sketching a new language on a whiteboard: Robert Griesemer, Rob Pike and Ken Thompson ². Yes, the Ken Thompson who wrote the first Unix in episode ten ²². Pike calls it Go's origin myth that the idea came during one of Google's forty-five-minute builds ¹³. Go was released as open source on the tenth of November, 2009 ².

Simple on purpose 7:44

Go's designers felt you had to choose between fast compiling, fast running and easy writing, and they wanted all three ². Go has just twenty-five keywords, its reserved words; we counted them in its specification ²³. There's no pointer arithmetic, meaning code can't do sums on a memory address to reach somewhere it shouldn't, and array bounds are always checked ¹³. Memory goes back through a garbage collector; you can't free it by hand ¹³.

The same bug, in Go 8:14

Here's episode ten's mistake, written in Go ¹⁷. A list with room for four numbers, and a loop that counts from zero up to and including four ¹⁷. It fills slots zero to three, then stops itself: index out of range, four, with length four ^23,17. In C, that same slip was undefined behaviour, and needed a special tool to catch ^24,25. So Rust catches ownership mistakes before the program runs, and Go stops a bad index as it happens ^12,23.

Many things at once 8:46

Go was also built for chips with many cores ². Put the word go in front of a function call, and it runs alongside everything else, as a goroutine, and goroutines pass values to each other through channels ²³. In our run, three goroutines each square a number and send it down a channel ¹⁷. The finishing order can change, but the total didn't: fourteen, all five times ¹⁷. One honest caveat from Rob Pike: when goroutines share memory, Go isn't purely memory safe ¹³.

Do you have to rewrite everything? 9:22

So why not rewrite everything? Even Hoare told Mozilla in 2010 that rewriting the browser was impossible ¹. Google's Android team tried something else: from around 2019, they wrote new code in memory-safe languages and mostly left the old code alone ²⁶. Memory safety bugs fell from seventy-six per cent of Android's vulnerabilities in 2019 to twenty-four per cent so far in 2024 ²⁶. That's under a third of the 2019 share, by our calculation ²⁶. Google's explanation: most bugs live in new code, and old code gets safer as it ages ²⁶.

Nothing is free 10:04

The Rust book admits ownership takes time to get used to ¹². In Rust's own 2024 survey, users named slow compiling as the biggest drag on their work ²⁷. Rob Pike admits Go's garbage collector brings overhead and delays ¹³. And generics, which let one function work with many types, were Go's most requested feature, and only arrived in 2022 ²⁸. In Stack Overflow's 2025 survey, of the thirty-one thousand-odd developers who answered, about sixteen per cent had done serious work in Go in the past year, and fifteen per cent in Rust, both behind C and C++ ²⁹. But Rust was the most admired language: seventy-two per cent of the people who'd used it wanted to keep using it ²⁹.

A bet on a trade-off 10:53

So why are people still inventing languages? Because each new one is a bet that an old trade-off doesn't have to be made. Rust bets you can have speed and control without the memory bugs ^3,12. Go bets you can have fast builds, fast programs and simple code, all at once ². Neither replaces C overnight; they shrink the problem one new line of code at a time ²⁶. And sometimes, a language from the nineteen-seventies is still the right tool. Why do so many apps still talk to their databases in a nineteen-seventies language?

Sources

Every factual claim in the episode is tied to one of these. Spotted an error? Tell us.

1. Graydon Hoare, "Project Servo: Technology from the past come to save the future from… — venge.net
2. The Go Programming Language, "Frequently Asked Questions (FAQ)" — go.dev
3. Microsoft Security Response Center, "A proactive approach to more secure code" (16… — msrc.microsoft.com
4. Microsoft Security Response Center, "We need a safer systems programming language" (18… — msrc.microsoft.com
5. National Security Agency, Cybersecurity Information Sheet "Software Memory Safety"… — web.archive.org
6. CISA, NSA, FBI, ASD's ACSC, CCCS, NCSC-UK, NCSC-NZ and CERT NZ, "The Case for Memory… — cisa.gov
7. The Chromium Projects, "Memory safety" — chromium.org
8. Google Security Blog, "An update on Memory Safety in Chrome" (21 September 2021) — security.googleblog.com
9. NSA press release, "NSA Releases Guidance on How to Protect Against Software Memory… — nsa.gov
10. CISA and FBI, "Product Security Bad Practices" (version 2, January 2025) — cisa.gov
11. CISA and NSA, "Memory Safe Languages: Reducing Vulnerabilities in Modern Software… — cisa.gov
12. The Rust Programming Language, 4.1 "What Is Ownership?" — doc.rust-lang.org
13. Rob Pike, "Go at Google: Language Design in the Service of Software Engineering"… — go.dev
14. Clive Thompson, "How Rust went from a side project to the world's most-loved… — technologyreview.com
15. The Rust Core Team, "Announcing Rust 1.0", Rust Blog (15 May 2015) — blog.rust-lang.org
16. Rust Foundation, "Hello World!" (8 February 2021) — foundation.rust-lang.org
17. This episode's own check, calc.py (run 2026-10-08 on an Apple silicon Mac: Go…
18. Lin Clark, "Inside a super fast CSS engine: Quantum CSS (aka Stylo)", Mozilla Hacks… — hacks.mozilla.org
19. The Linux Kernel documentation, "Programming Language" — docs.kernel.org
20. The Rust Programming Language, 4.2 "References and Borrowing" — doc.rust-lang.org
21. The Rust Programming Language, 20.1 "Unsafe Rust" — doc.rust-lang.org
22. Dennis M. Ritchie, "The Development of the C Language" (HOPL-II, 1993; read from the… — bell-labs.com
23. The Go Programming Language Specification (language version go1.27, 26 May 2026) — go.dev
24. ISO/IEC JTC1/SC22/WG14, N3220, the working draft that followed C23 (Annex J.2: an… — open-std.org
25. Clang documentation, "AddressSanitizer" (the memory error detector S05E10 used to… — clang.llvm.org
26. Google Security Blog, "Eliminating Memory Safety Vulnerabilities at the Source" (25… — security.googleblog.com
27. Rust Blog, "2024 State of Rust Survey Results" (13 February 2025) — blog.rust-lang.org
28. The Go Blog, "Go 1.18 is released!" (15 March 2022) — go.dev
29. Stack Overflow Developer Survey 2025, "Technology" (programming, scripting and markup… — survey.stackoverflow.co

Researched and scripted with AI assistance, fact-checked claim by claim, with synthetic narration and diagrams drawn in code. How we make episodes.