3 ms·
From a supply-chain perspective, Cargo is still in the same broad risk category as npm and PyPI: installing packages means trusting externally published code, i
by r2vcap 3mo ago
From a supply-chain perspective, Cargo is still in the same broad risk category as npm and PyPI: installing packages means trusting externally published code, including code that may execute during build or installation.
Rather than looking for someone to blame - in this case, GitHub - we should focus on constructive ways to harden the ecosystem.
- rndhouse 3mo agoI'm working on a tool for collaboratively reviewing Rust crate dependencies: https://github.com/thirdpass-org/thirdpass https://github.com/thirdpass-org/thirdpass Also supports npm, PyPI, and Ansible Galaxy.
- kelnos 3mo agoThat's a separate issue of supply-chain risk, and crates.io using GitHub auth isn't really material to that. The gripe with using GitHub auth for crates.io is that GitHub is owned by a large, fickle corporation with a (shall we say) complicated history with open source, and people object on principled grounds to being forced to use GitHub in order to participate in the crates.io ecosystem.