4 ms·
Is cargo more vulnerable to supply chain attacks than downloading a C++ lib and compiling?
by SnowHill9902 5y ago
Is cargo more vulnerable to supply chain attacks than downloading a C++ lib and compiling?
- hamandcheese 5y agoI’m not a big Rust user, but my understanding is that Cargo.lock contains checksums. So the answer to your question would be no. Downloading a C++ lib and using Cargo are both effectively trust on first use.
- eminence32 5y agorust might be more vulnerable in practice because it's so easy to add 3rd-party code (and update 3rd-party code).
- carlmr 5y agoExactly. In C++ everybody just writes their own libraries which enable other kinds of bugs and vulnerabilities.