As a member of the pony core team, I'm not comfortable saying Pony is safer than Rust. The approach of the two is different; each with their own trade-offs.

Given how easy it is to use c-ffi from Pony, it can be hard with existing tooling to feel confident in what your Pony code might do. Once you call out via C-FFI, all safety guarantees are off.

In this way, the c-ffi in Pony is as problematic for reasoning about safety as `unsafe` is in Rust.

Pony allows you to turn off FFI for all packages except for some that you allow but even then, FFI is an end around for the memory safety and capabilities security that the language otherwise provides.

Improving FFI tooling is an ongoing conversation amongst the core team.