5 ms·
Some background on this: Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm (there is https://cr
by pornel 8y ago
Some background on this:
Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm (there is https://crates.io/crates/left_pad https://crates.io/crates/left_pad if you're wondering).
This of course raises the question: what if someone puts some malware in a crate? Cargo itself has an OK security (and working on more end-to-end integrity checks), so it's unlikely that someone will inject malware into existing crates, but that still leaves question of trusting the original crate authors.
Rust is not a sandbox language. Even the "safe" subset of the language is still just about preventing bugs, but nowhere near a watertight sandbox required to protect programmers and users from straight-up malware running in their own program. It's not clear if that is even possible in an efficient, low-level systems programming language.
So the most reasonable way forward is to ensure that all code you use is either from people you trust, or has been verified by you or someone you trust.
Turning code reviews into a shareable artifact is a pretty cool addition here, as it reduces duplication of work across the community (you don't have to review everything personally), and helps you pick and choose who you trust.
- nicoburns 8y agoI'm pretty sure the left-pad crate is a joke. That functionality is in the standard library...
- deleted 8y ago[deleted]
- tln 8y agoThe only dependency of left_pad: https://crates.io/crates/kik https://crates.io/crates/kik "waiting for a takedown notice :P"
- richardwhiuk 8y agoThat's not a dependent on left pad, that's something which depends on left pad.
- eridius 8y ago> Rust is not a sandbox language. Even the "safe" subset of the language is still just about preventing bugs, but nowhere near a watertight sandbox required to protect programmers and users from straight-up malware running in their own program. Not only that, but even just the act of building a dependency is unsafe as dependencies can specify build scripts (which is just Rust code that's compiled and executed prior to building the crate).
- stcredzero 8y agoCargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm This of course raises the question: what if someone puts some malware in a crate? Do decentralized web of trust schemes actually work? What are the precedents? AFAIK, only centralized webs of trust work, and even those still leak around the edges and take some degree of active policing to defend. Basically, someone (or maybe a few competing someones) with authority establishes a canonical boundary and publishes a canonical list.
- jake_the_third 8y ago> only centralized webs of trust work How can you claim that? Looking at most tech we have today, it becomes readily apparent that most technology needs multiple iterations before achieving wide adoption. Web of trust is no exception. The lack of a widely-adopted precedent implying that some tech is forever poor is a sloppy conclusion to make.
- stcredzero 8y agoThe lack of a widely-adopted precedent implying that some tech is forever poor is a sloppy conclusion to make. Yes, but decentralized webs of trust have been tried before, and the "flat" ones with no centralization fade away or become hipster tchotkes. I think it's a valuable question to ask. Have we done the analyses for why the previous ones didn't work?
- reindeerer 8y agoMoxie Marlinspike came up with the concept of trust agility some time ago. I think it's imperative that the agility of the trust network is guaranteed, because this can be a fast changing situation.