3 ms·
Does cargo have the same inherent security issues we've been seeing with NPM? i.e. You're trusting the libraries and the moderation or lack thereof, of the repo
by photoGrant 4y ago
Does cargo have the same inherent security issues we've been seeing with NPM? i.e. You're trusting the libraries and the moderation or lack thereof, of the repository?
- pornel 4y agoYes, you have to trust the dependencies you use with Cargo. Rust is not a sandbox language. Rust's safety is only for catching mistakes, not a defence against actively malicious code. There are projects like https://lib.rs/cargo-crev https://lib.rs/cargo-crev and https://lib.rs/cargo-vet https://lib.rs/cargo-vet for tracking code reviews and verified-to-be-safe dependencies.