How Rust’s standard library was vulnerable for years and nobody noticed

The article touches on this with a quote from the security team:

> - We don’t have the time or inclination to work on updating this policy until after the [2018] edition ships

> — We’d rather take the time to get it right, but don’t have the time right now

This is a formal verification project that has already found some bugs: http://plv.mpi-sws.org/rustbelt/ Interestingly, it's also found some cases where type bounds were unnecessarily restrictive.