5 ms·
Except now You only need to audition the Unsafe part, which should, and usually is being utilized to minimum, rather then the entire project.
by Xeamek 3y ago
Except now You only need to audition the Unsafe part, which should, and usually is being utilized to minimum, rather then the entire project.
- galangalalgol 3y agoAnd even if the crate with ffi isn't compromised, they are the most likely spots for a cve anyway. Openssl and libcurl bindings for instance. So we should be paying attention to them anyway. I always prefer a pure safe rust crate for that reason, and because it is easier to deploy as a from scratch container or stand alone binary built against musl. Openssl and libcurl have permissive licenses so they are statically linked anyway, and there are no other options of course.