3 ms·
Yes, but most dependencies are generally from different authors so the chance of malicious actors goes up with dependencies.
by shukantpal 5y ago
Yes, but most dependencies are generally from different authors so the chance of malicious actors goes up with dependencies.
- khimru 5y agoJust look here: https://github.com/dtolnay?tab=repositories https://github.com/dtolnay?tab=repositories David Tolnay have 89 repos and if you are doing any Rust work at all the chances are high that you would have dozen of them in your dependency chain. Would merging of them help security? I don't think so: most of these crates are useful but they are quite diverse and it doesn't make much sense to put them into one package.
- dathinab 5y agoKinda, but also depends on the language a lot. E.g. in rust it's not uncommon to sometimes split libraries, e.g. -derive libraries (proc macros/derives), -sys (C-bindings without any logic/abstraction, most times auto-generated), and internal components. So counting just the number of "dependencies" can easily get you results, which are way off. Like actix-web has over 10 internal dependencies. (through I should note that they are in the same physical package/uploaded archive, i.e. they are treated as separate packages by rust, but are a single upload, have a single version number etc.).