3 ms·
I believe what's being suggested is that `cargo audit` should be a part of cargo rather than an add on. You'd obviously already have cargo installed, which mea
by cogman10 2mo ago
I believe what's being suggested is that `cargo audit` should be a part of cargo rather than an add on.
You'd obviously already have cargo installed, which means you should be able to run a command against cargo to see if you are currently exposed to any security problems. Even if it's not the current "audit" add on.
- conradludgate 2mo agoAs someone using bazel at work, the find script was much more amenable to me trying to audit our usage - we don't use cargo, so no cargo cache or cargo audit, but I can still figure out whether a particular package was downloaded.
- fc417fc802 2mo agoIf you're using a different tool then it falls to that tool to address the same problem. The point is that I shouldn't have to already know that a compromise has occurred and then go looking for it manually. The tooling should automatically start shouting at me very loudly that something happened with one of the packages I'm using.
- eminence32 2mo agoWell, but as a system admin, I might not have cargo installed even if my users have it installed in their home directory. So a simple non-Cargo command (like find) has a lot of advantages for me