Debian 8.7 released

Rewriting the ecosystem in Rust would require no small effort. Luckily Debian isn't a giant monolith, and you can focus on one package at a time. If you're really serious about digging in, then choose a package that you think would be a good balance between security gain (e.g. something with a history of memory-type security bugs) and effort required, start with that.

The existing maintainer of that project (I mean the software maintainer, not the Debian package maintainer) may or may not be open to a Rust rewrite. But this is open-source, and if they aren't, you can just fork (if calling a rewrite a 'fork' makes sense...) and publish your code somewhere. Then you can work with Debian folks to get your version packaged, and it will be available as a safer alternative for people who want to use it.

Over time, and as this starts happening to more and more software, Debian can start migrating to using these packages by default instead of the older unsafe ones.

And if they don't, again, it's open-source. Someone can make a Debian derivative (there are many already, including most famously Ubuntu) that uses the Rust versions of all packages when possible by default.

Disclaimer: this post presents just one possible version of future events, with the goal of clarifying what steps are required if you really believe in this, and want to see it happen. I am not affiliated with the Debian project other than as a user and software author with packages in the Debian archive.

Many of these rewrite attempts are quick hacks that are abandonded once very basic functionality is present.

For most users Rust vs C/C++ doesn't matter so your rewrite has to be better, not only in security (which is very abstract for users), but better performance / easier to configure / smaller / etc.

It is definitely about time, many small tools and utils that has existed for 15-20 years are very crufty when you open the hood and dive into the source.