Rust, C++, and the Tradeoffs Behind Safe Low-Level Code