6 ms·

It transitively expands out to 47 unique packages? Still doesn't seem that crazy to me: $ cargo tree -e no-build --prefix none | sort | uniq | grep -v sudo |

• int_19h 3y ago
  For something like sudo - which is the kind of app where you want to carefully audit the code line by line - this does look pretty bad.
  • tialaramex 3y ago
    > the kind of app where you want to carefully audit the code line by line This should be much less necessary for Safe Rust. The existing C sudo needs libpcre2, and OpenSSL neither of which are small - among other dependencies. Some of these dependencies do use unsafe Rust in places, and so it's valuable that those places should be inspected carefully (and not only for sudo) - but many do not, humantime for example is entirely safe Rust. Is it possible it has a logic error of some sort? Yes. Is it likely it somehow introduces a security hole? Not really. A C equivalent could easily introduce a critical buffer overflow, use after free or similar but that's not possible in safe Rust.
    • akira2501 3y ago
      sudo doesn't strictly need OpenSSL. That dependency is part of it's log server client implementation, and it's also available for the plugin system. I had no idea sudo even had the need for plugins. Which raises the question, maybe there's a need for two different sudo implementations. One that provides the simplest possible implementation of the feature, and another one that provides fancy log server and plugin integrations.
  • IshKebab 3y ago
    Are you worried about supply chain attacks? Because those are still extremely rare. Or are you worried about bugs in dependencies? Because it's not like C sudo doesn't have dependencies. Would you prefer that they implemented SHA2 themselves rather than using the battle tested crate that everyone else uses?
    • int_19h 3y ago
      For something like this, I think I would actually prefer that they copied existing code for hashing. It's simple and stable enough to avoid taking a dependency.
      • IshKebab 3y ago
        Existing code like the code in the sha2 crate??
        • int_19h 3y ago
          Sure. Or rather the parts of it that they're actually using.
          • IshKebab 3y ago
            What would be the point of that?
            • int_19h 3y ago
              A single bundle of code is easier to audit and easier to package.
              • IshKebab 3y ago
                It's harder to package if you're using Cargo. Using the sha2 crate is one line. Copying the code into your project is a ton more work. Ease of auditing is debatable. Using shared popular libraries gives the benefit of lots of people using them. Plus actual code audits are very rare and of dubious value. They're mostly useful for finding out how well written the code is rather than finding bugs. For that your basically want fuzzing.