> They will (semi)randomly pick some third-party crate which in all likelihood is totally unvetted. That this is the norm for a language that focuses on securi

> They will (semi)randomly pick some third-party crate which in all likelihood is totally unvetted. That this is the norm for a language that focuses on security is mind-boggling. Didn't we learn anything from the NPM mess?