As close to 'no notes' as this beat gets. Read the code.
A modern TLS implementation that takes safe defaults seriously, documents its threat model, and maintains a test corpus that embarrasses older libraries. The few low findings are doc nits.
§1 · Context
rustls is a TLS 1.2 + 1.3 implementation written without unsafe
outside of FFI boundaries. Its safe-by-default posture is documented,
defended, and tested. Running our compliance corpus was, frankly, a
relief after months of reading JavaScript auth code.
§2 · Findings
One low finding: the crate-level README could more prominently explain
the dangerous_configuration feature flag and why you should never set
it. Merged in v0.23.
§3 · Supply chain
The release process is reproducible, attested, and the maintainers have resisted the gravitational pull of adding "convenience" crates that would expand the trust surface. That discipline compounds.
§4 · Bottom line
If you can replace a C TLS library with rustls, do so.