Was only a question of time. Rust has the same mindset as Node/NPM.
PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:
If you have a proper stdlib, chances are, you don't have a lot of dependencies
If you have less dependencies, the chance of supply chain attacks drops significantly
If you have well established dependencies like Spring, their security practices are very likely better than a rando off the internet
What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.
If you have a proper stdlib, chances are, you don't have a lot of dependencies
This is why you seldom hear about supply chain attacks on nuget. Not only does .NET come with a lot of stuff built in, many common packages are provided by Microsoft themselves.
Even the most popular library, Newtonsoft.json, was largely obsoleted by the .net team vastly improving their first party json library to the point where I typically see most people recommending people migrate back to the core library.
Funnily enough, the creator of Newtonsoft.Json was hired by Microsoft back in 2018. From what I remember he's not on the team that created/maintains System.Text.Json though.
I mean there are a lot of third-party packages used frequently. Things for testing, validation, some utilities like humanizer, masstransit/nservicebus, etc. Even larger ui projects like avalonia or uno are out there.
114
u/piesou 12d ago edited 12d ago
Was only a question of time. Rust has the same mindset as Node/NPM.
PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:
What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.