3 ms·
So, don't add dependencies before you audit the code? That seems like a pretty reasonable ask to me.
by bigstrat2003 2mo ago
So, don't add dependencies before you audit the code? That seems like a pretty reasonable ask to me.
- Aeolos 2mo agoYou audit the code, then you run cargo update and you are pwned. Asking the user to not make mistakes is the c++ approach to security - it doesn’t work.
- burnt-resistor 2mo agoYou're creating a strawman. Don't run cargo update without verification, duh. > Asking the user to not make mistakes is the c++ approach to security Then demand crates.io do better by actually curating every version of every published crate.