3 ms·
Only if you don't buy any downsides with it. That makes it situational dependent. For example: - less people being able to read the code, work with the code, fi
by davrosthedalek 1y ago
Only if you don't buy any downsides with it. That makes it situational dependent. For example:
- less people being able to read the code, work with the code, find (security) bugs
- slower
I know, I know, rust is not really slower, and for sudo it probably wouldn't even matter. But safety isn't the be all and end all of software. There is a lot of software out there where memory safety doesn't matter, or matters a lot less than other aspects.
- 778464636 1y agoSupply chain attacks is a big downside no one ever mentions. Even sudo-rs drags dependencies in from Github at build time instead of being self-contained, which is just an absurd thing to do for such an essential tool, especially in the current political climate.
- estebank 1y ago1) every dependency comes from crates.io, not straight from GitHub 2) the dependency list is tiny 3) it uses a cargo lock, so even if it were using a GitHub dependency, that file keeps a hash of the dependency and points at the specific commit, so if the dependency were to introduce a backdoor it wouldn't be automatically picked up and a commit history rewrite would also fail https://github.com/trifectatechfoundation/sudo-rs/blob/main/Cargo.lock https://github.com/trifectatechfoundation/sudo-rs/blob/main/...