Fil-C's Safety Lives in the C Standard Library, Not the Language

Every decade, the software industry rediscovers the same bargain: the language gets credit for safety, and a runtime pays for it.

Fil-C's InvisiCaps capability model is the latest example. Memory safety is enforced at runtime, not at compile time, by a custom libc that wraps every syscall so out-of-bounds, use-after-free, and writes to read-only data all get caught before they reach the kernel. There is no unsafe escape hatch.

That detail is the real story, because Fil-C compiles Rust as readily as it compiles C. The C-versus-Rust framing in the Fil-C talk is the wrong read. What Fil-C actually offers is a portable safety floor beneath the language, one that any LLVM IR can sit on. Rust users gain a second line of defense; C codebases gain a path that does not require a rewrite.

The trust, though, is not gone. It moved. An auditor reading a Fil-C binary still has to read a libc they did not write. Fil-C's claim of full memory safety is correct, and the boundary is auditable, just at a different address than the one Rust draws it at.