36 ms·
I've never coded Rust - is there any distinction between a really important crate used by millions of people and something really obscure with 3 users? Are all
by rmtech 7y ago
I've never coded Rust - is there any distinction between a really important crate used by millions of people and something really obscure with 3 users? Are all the crates subject to security audit?
- steveklabnik 7y agoAnyone can upload to crates.io without review.
- pornel 7y agoThere is no technical distinction. The community is working on a WoT/review tool (cargo-crev), but in the meantime you can see who has published the crate and who uses it. The de-facto standard crates are maintained by Rust team members or well-known authors.
- rmtech 7y agook. So it's kind of informal at the moment. Maybe in the future we'll see more hacking of libraries (people managing to deliberately sneak exploits in) and in response stronger lockdowns on important library code.