Rust development

Rust for backend services that need to stay stable

Rust offers performance on par with C and C++, but with a type system that prevents memory errors and data races at compile time. That makes the language well suited to services that run unattended for long periods, handle sensitive data, or withstand heavy load without using more resources than necessary.

We have used Rust over time in our own open-source projects. Canary is a self-hostable, watch-only service for monitoring Bitcoin wallets, with around 1,800 commits. It is built with Axum and Tokio, uses BDK and Electrum to follow the blockchain, and has sign-in with JWT, Argon2, and TOTP, alerts by email and Nostr, multiple languages through rust-i18n, and packages for StartOS and myNode. Canary Mining is a Stratum V2 server for solo mining that talks to Bitcoin Core over IPC.

Rust, Go, or TypeScript — when we recommend Rust and when we do not

Rust is a good tool, but not a default. We recommend it when at least one of these requirements carries real weight:

• the service will run for months unattended and must handle network failures without stopping
• it handles keys, sign-in, or financial data, where a memory bug could become a vulnerability
• it will run on constrained hardware, for example for users who self-host
• a well-defined component is a bottleneck for performance or memory use

For ordinary CRUD APIs, internal tools, and products whose requirements are still changing quickly, we rarely recommend it. There, TypeScript or C# gives faster progress and a larger pool of developers. Go is a good middle ground for network services that should be easy to read and operate, with a gentler learning curve than Rust.

The cost of Rust is longer compile times, a steeper learning curve, and fewer developers to hire from. It is worth paying when bugs in production are expensive — not otherwise.

Memory safety and security-sensitive backends

Many vulnerabilities come from memory errors. Rust removes most of them, but secure software takes more than a safe language. We focus on storing passwords securely with Argon2, two-factor authentication, minimal access to sensitive data, and mature, well-maintained dependencies. In a Bitcoin context, this means for example building solutions that only need public keys and descriptors, so the service never has access to the funds it monitors.