19
Warning! Social engineering attacks for supply-chain in rust crates (blog.rust-lang.org)
submitted 1 month ago by to c/rust@lemmy.ml
5 comments fedilink hide all child comments
 

Supply-chain through social engineering

you are viewing a single comment's thread
view the rest of the comments
[–] -1 points 1 month ago (4 children)

Imo the package manager is one of the things in rust that it is holding back the most. Cargo, like npm is something that rapidly causes loss of control over dependency management, because your dependencies find it too easy to pull in more shit. That is an OS job, not a first class citizen of a language

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 3 points 1 month ago (3 children)

    Broadly I agree but I think the cargo tooling is one of the strengths of rust. The dependency downloading probably had to exist while rust was establishing itself and maturing as an ecosystem.

    FWIW I wouldn't touch npm with a barge pole.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 1 month ago (2 children)

    What are the differences between cargo and npm that make you approve of the former and disapprove the latter?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago (1 child)

    It's a fair question. Personally for me crates.io seems to exercise good taste in what it adds and unlike npm doesn't (yet) have a long history of exploits. Also npm seems more prone to dependency explosion (leftpad,is even etc). Also I feel as though I have a fighting chance understanding the rust source should I need to delve into it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 month ago

    I think you are right, but IMO the reason is just a difference in numbers. If crate.io ever gets as much users as npm the problems will become exactly the same.

    As soon as there is a situation where one dependency can decide tomorrow to pull in another one everybody is screwed. You might be comfortable with understanding the code, but if you don't have the time to fix it you are screwed either way. The customer always says "it worked yesterday, what do you mean you need to fix something? Work on this new feature instead". One year of this any you cannot manage your dependencies anymore and you have hundreds, welcome to npm.

  • permalink
  • fedilink
  • source
  • parent