4 ms·

The big lesson from this is that we maybe should spend a bit more time hardening the build process instead of rewriting everything in Rust. Also, I am a strong

• lifthrasiir 3y ago
  Or do both, because it also turns out that Rust build process is a real joy compared to that of C/C++ [1]. [1] Except when there are C/C++ dependencies :-)
  • uecker 3y ago
    It is a joy but makes it far too easy to pull in dependencies. And then Build.rs also runs. From a supply chain security perspective, Rust scares me.
    • lifthrasiir 3y ago
      I'm fully supportive to sandbox build.rs for that reason, but the same concern applies to pretty much everything in your computer so I'm not worried as much. In the other words, that risk is currently constant with respect to the choice of language.
      • armitron 3y ago
        It's not constant, most C projects don't have anywhere near the number of library dependencies seen in your typical cargo project. From a supply chain attack perspective, Rust and Node promote ecosystems that are total disasters.
        • lifthrasiir 3y ago
          Most software projects are not written in C. Conversely C would be used for projects where C would be less annoying than alternatives, and that condition largely precludes projects with many required dependencies. And every language-level package manager, not just that of Rust and Node, would be a disaster from the supply chain attack perspective---it can even be said that C is suffering from the huge amount of supply chain attacks in spite of the lack of good language-level package manager.