5 ms·

Why is a Debian developer a better gatekeeper against supply chain attacks than the developer of a popular Rust library? For me the alternative to Crates.io/np

by loftsy 3y ago

Why is a Debian developer a better gatekeeper against supply chain attacks than the developer of a popular Rust library? For me the alternative to Crates.io/npm/PyPi is a "platform release" like Android where a bunch of stuff is signed off by a corporation.

dathinab 3y ago
because it often takes so long to do any updates that people just give up on updating in time, weather that is for bug fixes or for injecting supply chain attacks /s/j
palata 3y ago
I would assume that the Debian _maintainer_ cares about what is being shipped with Debian. And for each dependency (transitive or not), the Debian maintainer has to make sure that it is shipped by Debian, and therefore has to not only know about the dependency, but also to make a package out of it (if it is not already being shipped by Debian). Whereas the developer of a popular Rust library most likely just added some dependencies that were convenient, and doesn't know the full story of the transitive dependencies. To me it is much more likely that somebody at Debian _saw_ the dependency being shipped than an arbitrary Rust developer, who probably does not even know how many dependencies are being shipped with their program.
throwaway322321 3y ago
Debian developers go through a long step-by-step process to get in that position. Volunteering as a package maintainer first, getting Debian dev to advocate for you, cross-checking people passports, doing interview/exams to become a DD. DDs review the libraries they package. All uploads are personally signed to keep people accountable. Instead opening a github account and developing a library can be done anonymously and there's been supply chain attacks done this way.
yjftsjthsd-h 3y ago
Well if nothing else, it's the difference between one person being able to ship something vs needing at least one person to review before shipping.
riku_iki 3y ago
maybe adaptation: debian has higher adaptation than rust, meaning more people will start screaming if something wrong is going.
- codys 3y ago
  I'm not sure how one would define "adaptation" (presumably meaning "adoption", ie: how widely used something is) in a way that could have debian have a higher adoption than rust: rust ships in programs within many linux distributions and other operating systems (mac os and windows). rust is used in widely used programs/kernels (Firefox, Chrome, Linux itself, Windows) that span further than debian itself. All this is to say: a large amount of debian users likely are using rust, and an even larger amount of non-debian users is likely to be using rust.
  - riku_iki 3y ago
    > rust is used in widely used programs/kernels (Firefox, Chrome, Linux itself, Windows) those few narrow components likely have good support.

by loftsy 3y ago

dathinab 3y ago

because it often takes so long to do any updates that people just give up on updating in time, weather that is for bug fixes or for injecting supply chain attacks /s/j

palata 3y ago

I would assume that the Debian _maintainer_ cares about what is being shipped with Debian. And for each dependency (transitive or not), the Debian maintainer has to make sure that it is shipped by Debian, and therefore has to not only know about the dependency, but also to make a package out of it (if it is not already being shipped by Debian). Whereas the developer of a popular Rust library most likely just added some dependencies that were convenient, and doesn't know the full story of the transitive dependencies. To me it is much more likely that somebody at Debian _saw_ the dependency being shipped than an arbitrary Rust developer, who probably does not even know how many dependencies are being shipped with their program.

throwaway322321 3y ago

Debian developers go through a long step-by-step process to get in that position. Volunteering as a package maintainer first, getting Debian dev to advocate for you, cross-checking people passports, doing interview/exams to become a DD. DDs review the libraries they package. All uploads are personally signed to keep people accountable. Instead opening a github account and developing a library can be done anonymously and there's been supply chain attacks done this way.

yjftsjthsd-h 3y ago

Well if nothing else, it's the difference between one person being able to ship something vs needing at least one person to review before shipping.

riku_iki 3y ago

maybe adaptation: debian has higher adaptation than rust, meaning more people will start screaming if something wrong is going.

codys 3y ago
I'm not sure how one would define "adaptation" (presumably meaning "adoption", ie: how widely used something is) in a way that could have debian have a higher adoption than rust: rust ships in programs within many linux distributions and other operating systems (mac os and windows). rust is used in widely used programs/kernels (Firefox, Chrome, Linux itself, Windows) that span further than debian itself. All this is to say: a large amount of debian users likely are using rust, and an even larger amount of non-debian users is likely to be using rust.
- riku_iki 3y ago
  > rust is used in widely used programs/kernels (Firefox, Chrome, Linux itself, Windows) those few narrow components likely have good support.