4 ms·
For almost any real world application, where people's data and businesses are at stake, developer convenience is a distant priority to security. Of course it's
by colmmacc 6y ago
For almost any real world application, where people's data and businesses are at stake, developer convenience is a distant priority to security. Of course it's great when we can have both, and making secure solutions the most convenient is key, but Rust doesn't quite get this right yet. If there's a security issue in one of those dependencies you are importing, how do you even know that you are impacted? What about when it's a dependency of a dependency? Making it easy for developers to suck in a huge TCB at build time has some serious downsides.
- jamesmishra 6y agoWhen security is a concern, developers can simply avoid using untrusted crates. But concerns over security are not reason for a package manager to not even exist. Pretty much every major language and operating system has a package manager. While supply chain attacks are real, they are not unique to Rust in any way.
- mplanchard 6y agoThe ecosystem also includes stuff like cargo-audit[0], with which you can easily add dependency auditing to your CI pipelines or whatever. People are definitely thinking about this problem. [0]: https://github.com/rustsec/cargo-audit https://github.com/rustsec/cargo-audit
- tijsvd 6y agoI very much agree with your point, and want to add that in certain contexts, the same goes for performance. I do think that Rust making it easy doesn't necessarily mean that you have to use it. It's fine to write applications using only the stdlib, and only link to some known libs like openssl or libpq. In Rust's defense, it is easy to list all dependencies, and they don't automagically upgrade from one checkout to another.