11 ms·

To be honest Rust has the exact same supply chain attack pattern - it's just newer and more maintained at the moment. Give it a decade.

nothinkjustai 5mo ago
Rust doesn’t have post install scripts
- tasn 5mo ago
  It has build.rs, which has essentially the same problems.
- deeebug 5mo ago
  They have build.rs (https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html)
- fabrice_d 5mo ago
  It has build.rs that will run as soon as you compile the dependency. That's not the same thing but pretty close to a post install script: it's very likely to run.
- est31 5mo ago
  There is build.rs, proc macros are unsandboxed, and lastly you install the binary so that you can run it. Even if the build and install were fully sandboxed, the binary could still do malicious stuff if ran.
  - drdaeman 5mo ago
    Even without post-install script, a malicious payload could be hiding in some function and just wait until the developer invokes `cargo run`. Not that many people audit the crates they pull into their projects.
  - nothinkjustai 5mo ago
    Yeah no shit, if you download malicious code from the internet and run it on your computer you will get pwned. No matter if it’s from a package manager a zip file or a submodule. However the current npm vulns used a post install script.
    - mort96 5mo ago
      I maintain that NPM malware use postinstall scripts just because they exist and are convenient. Had NPM not had postinstall scripts, the malware would have used a different mechanism and been almost exactly as effective.
slopinthebag 5mo ago
Supply chain attacks are available to every language and framework that uses dependencies or modules you don’t control.
marcosdumay 5mo ago
Programs in Rust (or almost every other language) normally have fewer dependencies by 2 or 3 orders of magnitude. And that number tends to reduce even more when the ecosystem matures.
- rascul 5mo ago
  It may be fewer but it still doesn't feel good when cargo pulls in hundreds of deps for a seemingly simple application. But maybe it seems simple because of all the deps...
  - anthk 5mo ago
    This; even Golang for medium sized projects (NNCP, Yggdrasil) have about 8-10 deps on average. Rust's dependency chain it's unmanageable for a distro manager.
  - marcosdumay 5mo ago
    Agreed, but that's the reason why it keeps being a huge problem in JS while other languages only have an eventual small trouble. But also, almost all of those deps on all simple apps are the same in Rust. They are the same for a large part in JS too, but it's for a smaller part than on most languages.
- anthk 5mo ago
  From Golang the Rust dependency size it's closer to NPM than Go.
aselimov3 5mo ago
Yea I’m a big fan of rust but it does feel uncomfortable to see my dependency blowing up to the hundreds when I build

nothinkjustai 5mo ago

Rust doesn’t have post install scripts

tasn 5mo ago
It has build.rs, which has essentially the same problems.
deeebug 5mo ago
They have build.rs (https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html)
fabrice_d 5mo ago
It has build.rs that will run as soon as you compile the dependency. That's not the same thing but pretty close to a post install script: it's very likely to run.
est31 5mo ago
There is build.rs, proc macros are unsandboxed, and lastly you install the binary so that you can run it. Even if the build and install were fully sandboxed, the binary could still do malicious stuff if ran.
- drdaeman 5mo ago
  Even without post-install script, a malicious payload could be hiding in some function and just wait until the developer invokes `cargo run`. Not that many people audit the crates they pull into their projects.
- nothinkjustai 5mo ago
  Yeah no shit, if you download malicious code from the internet and run it on your computer you will get pwned. No matter if it’s from a package manager a zip file or a submodule. However the current npm vulns used a post install script.
  - mort96 5mo ago
    I maintain that NPM malware use postinstall scripts just because they exist and are convenient. Had NPM not had postinstall scripts, the malware would have used a different mechanism and been almost exactly as effective.

slopinthebag 5mo ago

Supply chain attacks are available to every language and framework that uses dependencies or modules you don’t control.

marcosdumay 5mo ago

Programs in Rust (or almost every other language) normally have fewer dependencies by 2 or 3 orders of magnitude. And that number tends to reduce even more when the ecosystem matures.

rascul 5mo ago
It may be fewer but it still doesn't feel good when cargo pulls in hundreds of deps for a seemingly simple application. But maybe it seems simple because of all the deps...
- anthk 5mo ago
  This; even Golang for medium sized projects (NNCP, Yggdrasil) have about 8-10 deps on average. Rust's dependency chain it's unmanageable for a distro manager.
- marcosdumay 5mo ago
  Agreed, but that's the reason why it keeps being a huge problem in JS while other languages only have an eventual small trouble. But also, almost all of those deps on all simple apps are the same in Rust. They are the same for a large part in JS too, but it's for a smaller part than on most languages.
anthk 5mo ago
From Golang the Rust dependency size it's closer to NPM than Go.

aselimov3 5mo ago

Yea I’m a big fan of rust but it does feel uncomfortable to see my dependency blowing up to the hundreds when I build