3 ms·
> There is more and more tooling around to help mitigate the risk, he said. Could anyone expand on this? I could imagine tools... better static analysis, maybe
by yjftsjthsd-h 2y ago
> There is more and more tooling around to help mitigate the risk, he said.
Could anyone expand on this? I could imagine tools... better static analysis, maybe? being able to help. But I'd really want to see details. Both to see if it really helps, and because if there is tooling to help then I want to know so I can adopt it!
- krater23 2y agoStatic analysis is embedded in rust, but you can't mitigate intended malicious behavior of software dependencies. That would be like a virus killer for dependencies. The past has shown that this isn't working.
- panstromek 2y agoThere's cargo vet, cargo audit and I think various other tools. There's also a process for reporting and removing malicious ones and stuff like that, like you'd expect. Rust didn't really have a major supply chain attack as I'm avare. I remember one typo-squat with malicious code, but that was found pretty quickly and don't think it was exploited.