2 ms·
Also to note that RS domain is Serbia, who could simply redirect all rust users to malicious domains in a supply chain attack.
by downrightmike 7mo ago
Also to note that RS domain is Serbia, who could simply redirect all rust users to malicious domains in a supply chain attack.
- nyc_pizzadev 7mo agoHow realistic is for a TLD “owner” to take over a domain like this?
- vasachi 7mo agoDoesn't USA do that all the time with .com and such?
- estebank 7mo agoHow would that get around the SSL certificate?
- nyc_pizzadev 7mo agoIf you control the domain, LetsEncrypt will happily issue you a fresh certificate.
- kpcyrd 6mo ago1) This is only relevant for rustup.rs, most Rust source code is coming from crates.io 2) Most projects have a Cargo.lock that contain sha256 checksums of the source code. You can still announce new versions of everything and hope people pull them in through `cargo update`, but you are not going to get anywhere close to "all Rust users".