2 ms·

Since source is available, of course you should audit it, or at least glance over it before compiling. You should realize that this is not feasible for everyon

by ktm5j 8y ago

Since source is available, of course you should audit it, or at least glance over it before compiling. You should realize that this is not feasible for everyone as most people are not developers.. and even in the subset of people who both how to write software and (in this case) know rust, how many are really qualified to audit a software project for malicious code or vulnerabilities? I'm a professional developer and I'm certain someone could slip some obfuscated code in a project with several thousand lines of code and I'd never know it.

code_duck 8y ago
That's why I would wait for other people to find that out, if I can't trust or audit it myself. Agreed that a brand new package from an unknown single developer is more risky. As far as a trap with clever obfuscation, it sounds like any software we use could be vulnerable to that. It could be added as a patch to a seemingly routine update for any of the thousands of packages on your system.