3 ms·
> I get GitHub alerts for vulnerabilities in the dependencies of my Rust programs, and I release new versions whenever there's a relevant vulnerability. That's
by kelnos 2y ago
> I get GitHub alerts for vulnerabilities in the dependencies of my Rust programs, and I release new versions whenever there's a relevant vulnerability.
That's great, but my confidence is very low that most maintainers are like you.
- sunshowers 2y agoSure! I'm an optimist at heart and think a lot of people can learn though :) And note that static linking doesn't prevent third-party distributors like Linux maintainers from patching software. It's just that a lot of the current tooling can't cope too well with tracking statically linked dependencies. But that's just a technical problem. GitHub's vulnerability tracking has been fantastic in this regard.