Make native functions unsafe

[brson]

Very frequently I find myself marveling at the amount of unsafe code I can write without an unsafe block. Using native functions is the fastest way to segfault your rust but it usually doesn't require any special authorization. Unsafe native functions 2012.

[pcwalton]

Agreed, these should be unsafe or explicitly marked safe with the same amount of ceremony required to enter an unsafe block.

[catamorphism]

Agreed as well. Safe should mean "safe".

[pcwalton]

I feel very strongly about this after working on Servo for a while. Most of our exploitable crashes are in safe code. If we don't do this I feel that Rust will, in a practical sense, have no more safety guarantees than C++.

How can a security auditor hope to audit Rust code if every single call could do wildly unsafe things?

[thestinger]

This is now implemented.