3 ms·
On the argument of "you're not reading build.rs anyway": yes, but you can, and that's a critical difference. "No one" is validating all their transitive depend
by andrewflnr 3y ago
On the argument of "you're not reading build.rs anyway": yes, but you can, and that's a critical difference.
"No one" is validating all their transitive dependencies for weird binaries, except a few people, and that's enough to get us all here talking about it. In the internet age it only takes one. But if you make it require more work to inspect a blob, you reduce the chances that you'll get even that one person who sounds the alarm. At minimum malicious code will survive longer that way.