3 ms·
In Rust we have cargo vet, where we share these audits and use them in an automated fashion. Companies like Google and Mozilla contribute their audits.
by weinzierl 1y ago
In Rust we have cargo vet, where we share these audits and use them in an automated fashion. Companies like Google and Mozilla contribute
their audits.
- quotemstr 1y agoAnd it's a great idea, similar thematically to certificate transparency
- gedy 1y agoIt's too bad MS doesn't own npm, and/or GitHub repositories. Wait
- LikesPwsh 1y agoNuget, Powershell gallery, the marketplaces for VSCode/VS/AZDo and the Microsoft Store too. Probably another twenty. They collect package managers like funko pops. I'm not quite sure about the goal. Maybe some more C# dev kit style rug-pulls where the ecosystem is nominally open-source but MS own the development and distribution so nobody would bother to compete.
- lovich 1y agoI took those acquisitions and a few others like LinkedIn and all the visual studio versions as a sign that Microsoft is trying to own the software engineer career as a domain.
- pabs3 1y agoI wish cargo went with crev instead, that has a much better model for distributed code audits. https://github.com/crev-dev/ https://github.com/crev-dev/
- oneshtein 1y agoHow to backport security fixes to vetted packages?