- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,375
The low-level code will be equipped with a “hazard sign” so that it catches the eye of the reviewers.
Microsoft is preparing a major change in memory security for C#. The language is not going to be turned into Rust and deprive the usual automatic memory control, but working with dangerous areas of the code will become more noticeable, stricter and clearer for verification.
About the plans told the product manager. NET Richard Lander in a large text about the future of memory safety in C#. The team wants C# to be one of the languages that choose not only for the convenience of development, but also for monitoring the types and safety of memory. The main part of the plan is related to the new meaning of the keyword unsafe, which in C# allows you to use pointers and directly refer to memory.
Most business app developers almost never write an unsafe code. In the usual development, there is enough controlled memory. NET and garbage collector, who himself monitors objects and free up resources. But low-level tasks sometimes require direct access to memory: interaction with the operating system, working with device memory, speedly critical areas of the program or code where pointers are needed.
In the early books on C# unsafe described almost as an insert of C-code inside the C#-program. This mode allows the use of signs and operations with them, and the garbage collector. NET does not track the memory to which the signs are referred. Now the unsafe modifier basically opens access to low-level capabilities, but in itself almost does not affect the type or member of the class.
In C# 16, the behavior will change. The version should be released at the end of 2027 together with . NET 12, which will receive LTS status, that is, long-term support. The preliminary version of the new model is expected earlier, in C# 15 and . NET 11.
According to the current specification project, the unsafe method will simultaneously require unsafe content from the calling code. In other words, the dangerous zone will begin to spread up the chain of challenges, until the developer clearly limits the area inside the method. A safe baseline method will also not be redefined by unsafe version unless the original class member requires a dangerous context.
A separate modifier safe is not yet introduced, although some developers ask for just such a clear mark to suppress the spread of unsafe. Lander признаётadmits that he himself supports this option and discusses the approach with the language design team.
Another important change concerns the scope of unsafe. In the future, unsafe will not be able to hang on the whole class or structure at once. The developer will have to celebrate specific places where the code really works with memory directly: individual methods, properties and fields. So the reviewers will see the site faster where the program goes beyond the usual safety model.
Microsoft is also revising the very concept of a dangerous operation. Using a pointer type and some of the signs expressions will no longer be automatically considered unsafe. Dangerous are recognized when the code exchanges the index and gets access to uncontrolled memory. The new approach should separate the very storage of the address from real reading or writing to the memory.
In C# 16, the new security model will be voluntary. Developers will be able to continue working according to the old rules of C# 1.0, but the operating environment libraries. NET will move to a new mode. Microsoft also looks at icons in NuGet, packet repositories for . NET, to show which libraries have already included the new model, and push the ecosystem to transition. In one of the future versions of C#, the company can make a new mode enabled by default.
The new scheme does not make unsafe code magically magically. The task is simpler and more practical: dangerous areas should be conspicuous, audited and accompanied by an understandable contract of use. Developers will be encouraged to describe the rules for dealing with unsafe members in the comments, and static analysers will be able to remind documentation and verify compliance
The community reaction is still mostly calm and rather positive. One of the developers who writes on C# and Rust, called the changes a step towards the managed Rust: C# will keep the garbage collector and the usual model. NET, but will get stricter boundaries around a code that can directly touch memory.
For authors of ordinary corporate applications, the transition will change almost nothing. Most of these projects do not use unsafe and will remain in the usual C# zone. But for libraries, execution environment, system code and high-performance components, the new model can become a noticeable increase: the dangerous code will not disappear, but it will stop hiding inside large classes and non-obvious challenges.
Microsoft is preparing a major change in memory security for C#. The language is not going to be turned into Rust and deprive the usual automatic memory control, but working with dangerous areas of the code will become more noticeable, stricter and clearer for verification.
About the plans told the product manager. NET Richard Lander in a large text about the future of memory safety in C#. The team wants C# to be one of the languages that choose not only for the convenience of development, but also for monitoring the types and safety of memory. The main part of the plan is related to the new meaning of the keyword unsafe, which in C# allows you to use pointers and directly refer to memory.
Most business app developers almost never write an unsafe code. In the usual development, there is enough controlled memory. NET and garbage collector, who himself monitors objects and free up resources. But low-level tasks sometimes require direct access to memory: interaction with the operating system, working with device memory, speedly critical areas of the program or code where pointers are needed.
In the early books on C# unsafe described almost as an insert of C-code inside the C#-program. This mode allows the use of signs and operations with them, and the garbage collector. NET does not track the memory to which the signs are referred. Now the unsafe modifier basically opens access to low-level capabilities, but in itself almost does not affect the type or member of the class.
In C# 16, the behavior will change. The version should be released at the end of 2027 together with . NET 12, which will receive LTS status, that is, long-term support. The preliminary version of the new model is expected earlier, in C# 15 and . NET 11.
According to the current specification project, the unsafe method will simultaneously require unsafe content from the calling code. In other words, the dangerous zone will begin to spread up the chain of challenges, until the developer clearly limits the area inside the method. A safe baseline method will also not be redefined by unsafe version unless the original class member requires a dangerous context.
A separate modifier safe is not yet introduced, although some developers ask for just such a clear mark to suppress the spread of unsafe. Lander признаётadmits that he himself supports this option and discusses the approach with the language design team.
Another important change concerns the scope of unsafe. In the future, unsafe will not be able to hang on the whole class or structure at once. The developer will have to celebrate specific places where the code really works with memory directly: individual methods, properties and fields. So the reviewers will see the site faster where the program goes beyond the usual safety model.
Microsoft is also revising the very concept of a dangerous operation. Using a pointer type and some of the signs expressions will no longer be automatically considered unsafe. Dangerous are recognized when the code exchanges the index and gets access to uncontrolled memory. The new approach should separate the very storage of the address from real reading or writing to the memory.
In C# 16, the new security model will be voluntary. Developers will be able to continue working according to the old rules of C# 1.0, but the operating environment libraries. NET will move to a new mode. Microsoft also looks at icons in NuGet, packet repositories for . NET, to show which libraries have already included the new model, and push the ecosystem to transition. In one of the future versions of C#, the company can make a new mode enabled by default.
The new scheme does not make unsafe code magically magically. The task is simpler and more practical: dangerous areas should be conspicuous, audited and accompanied by an understandable contract of use. Developers will be encouraged to describe the rules for dealing with unsafe members in the comments, and static analysers will be able to remind documentation and verify compliance
The community reaction is still mostly calm and rather positive. One of the developers who writes on C# and Rust, called the changes a step towards the managed Rust: C# will keep the garbage collector and the usual model. NET, but will get stricter boundaries around a code that can directly touch memory.
For authors of ordinary corporate applications, the transition will change almost nothing. Most of these projects do not use unsafe and will remain in the usual C# zone. But for libraries, execution environment, system code and high-performance components, the new model can become a noticeable increase: the dangerous code will not disappear, but it will stop hiding inside large classes and non-obvious challenges.
