5 ms·
Long story short is that I trust their quality. The community is great about vetting unnecessary uses of unsafe code. That’s more than can be said about hand r
by iknowstuff 3y ago
Long story short is that I trust their quality. The community is great about vetting unnecessary uses of unsafe code.
That’s more than can be said about hand rolled equivalents in C/C++.
- palata 3y agoSo if you have 200 dependencies, you trust them just because they don't run what Rust calls "unsafe" code? What about safe code that could be malware?
- rockdoe 3y agoFYI Google and Mozilla audit all their dependencies and share them: * https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml https://chromium.googlesource.com/chromiumos/third_party/rus... * https://searchfox.org/mozilla-central/source/supply-chain/audits.toml https://searchfox.org/mozilla-central/source/supply-chain/au... It's quite likely that most of your dependencies were already audited.
- meragrin_ 3y agoSo what in there guarantees I can get the same thing they audited?
- GrumpySloth 3y agoVersion numbers. You can’t modify an already-published version of a Rust crate on crates.io.
- palata 3y agoWho in practice pins their dependencies (transitive included) on audited versions?
- rockdoe 3y agoSmall companies with little development experience like Google and Mozilla. (You can check the files I linked and see audits between deltas for minor version updates)
- palata 3y agoI guess my point was: "because [some teams at] Google/Mozilla do it right does not mean that everybody does it right".
- rendaw 3y agoIsn't this hierarchical trust? You select immediate dependencies that you believe are written by reasonably security-conscious people, not just anything that immediately solves a problem, and because they're reasonably security-conscious people they select their own dependencies the same way? And at each level vetting is implicitly shared with other users of the dependencies, some of whom will be more critical/inquisitive. I've heard the alarms about dependencies and I'm not sold. I feel like this is bleeding over from the JS/frontend world where people don't choose to do the above, for whatever reason. Whenever I add a dependency in Rust I look at crates.io downloads, dependents (any big projects there?), github stars, I browse the issues to see what sort of problems have been reported and when, with what sort of replies from the author, how many contributors there are, release history, what commits look like, and what other stuff the authors have worked on. I use a lot of dependencies, and I do rewrite stuff myself when I feel like I can't rely on a dependency.
- palata 3y agoThat's the thing about trust: not everyone uses it the same. There are documented examples of malware being injected to millions of dependents through package managers, so we know that "hierarchical trust" does not work. The big difference with a distro is that I choose to trust the distro maintainers, which is only a handful of people. Whereas with your hierarchical trust, you choose to trust many random people.
- rendaw 3y agoI know I remember there being a couple big events in the news, and I know the Javascript ecosystem is also a bigger target also because it's so popular, but do you have examples of these attacks?