3 ms·

So now you replace your trust in crates.io with trust in the debian repository (which god knows how many people have access to?). At least on crates you get to

by Aeolun 3y ago

So now you replace your trust in crates.io with trust in the debian repository (which god knows how many people have access to?). At least on crates you get to know who is maintaining the package.

jjgreen 3y ago
Your trust in crates.io extends to their authentication, which is subcontracted to GitHub (and only GitHub) so Microsoft. Debian? Microsoft? ... that's a tricky one. https://github.com/rust-lang/crates.io/issues/326 https://github.com/rust-lang/crates.io/issues/326
- Aeolun 3y ago
  Wow, I’m more bothered by all the faffing around they do on that issue (write an RFC before developing, but discuss it on this issue more before writing an RFC) than the actual issue of a single auth provider.
  - jjgreen 3y ago
    Debian's internal procedures are arcane for sure, I'm not involved so don't see it as issue. It's having a single authentication provider which is Microsoft that I'd object to, and that would put me off using crates.io at all.
goodpoint 3y ago
Debian requires much more strict authentication.