88
Supply chain attack on arrayref (blog.rust-lang.org)
submitted 2 months ago by to c/rust@programming.dev
22 comments fedilink hide all child comments
 

If you recently used Cargo, make sure your system didn't get infected. Here is another article with a little more info: https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 months ago (1 child)

I'm still talking about programming language specific supply chain attacks, I'm just talking about those where the malicious code targets the user's computer. Especially in a language like rust where everything is linked statically, a simple update of a library can bring in malicious code, and generally a change such as "updated library X to Y.Z" will not be analyzed as slowly as code changes from the project itself. And while I personally prefer the concept of stable distros, the whole concept of stable distributions is that the software was used for an extended period of time before that, and you don't want those users getting malware, either - so that's not really the solution to the problem IMO.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 months ago*

    the whole concept of stable distributions is that the software was used for an extended period of time before tha

    Not quite, the whole concept of these ultra stable distros is that they take a version of the software, and essentially pin, it, cherrypicking mostly, or only security changes as updates. The version of the software that is selected, can be, and usually is from a much newer version of the software overall.

    Because of this, Debian and Ubuntu have an interesting pattern, where each one doesn't universally have older packages than the other. Instead, a new Debian release comes out, it has newer packages, then a new Ubuntu release comes out, and they alternate.

    Anyway, during the process of releasing a new stable distro, the programs are libraries are assessed, and then tested a bit before being included. In theory, if you had enough manpower, and you were fast enough, you could probably pin close to the current latest version of things, and then have those in your stable distro, even if they have only been out for a short period of time.

    The idea of "program version has been released for 2 years, now let's include them into a stable distro", is not how they actually work. Instead, the pinning and then security updates model, deduplicates a lot of work, because now you only assess the security and quality of the programs to be packaged once, instead of continuously every single update.

    It's not about eliminating bugs by using well tested programs. Stable distros are about ensuring the stability of the behavior of the system. The same set of, of predictable bugs, rather than a constantly changing set of them.

    If you use a stable distro as your programming language supply chain, you essentially don't have to deal with security updates in dependent libraries, or worry about supply chain security. Any dynamically linked language is able to do this, but my frustration with Rust is that this is not an option, which is something I really hope changes in the future.

  • permalink
  • fedilink
  • source
  • parent