3 ms·

If I look at actual incidence involving memory safety issues compared to supply chain issues in general, it is the later which is much a higher risk to me. And

by uecker 23d ago

If I look at actual incidence involving memory safety issues compared to supply chain issues in general, it is the later which is much a higher risk to me. And yes, there were successful supply chain attacks on Rust developers, even just recently: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/ https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... despite this being a "solved" problem. I think this becomes worse with AI not better, while memory safety risks will probably get much less in other languages after possibly some higher rate for a while.

orlp 22d ago
> If I look at actual incidence involving memory safety issues compared to supply chain issues in general, it is the later which is much a higher risk to me. Again, can you even just name a single supply chain attack that was *shipped* in Rust software? Against the thousands and thousands of known memory vulnerability bugs throughout time? > And yes, there were successful supply chain attacks on Rust developers, even just recently: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... despite this being a "solved" problem. No, your linked blog post predates the brand-new min-age requirement. The minimum age would have prevented it, since it was detected by AI within an hour. If anything it supports my point. Plus, as I already mentioned, that is a build.rs supply chain attack that targets developers, not shipped software.
- uecker 22d ago
  Well, the affected arrayref crate was downloaded 2k times. It is also not the first case. If AI magically finds all bugs in short time we have no problems anyhow. We also do not need Rust. A minimum age requirement is a good thing, but also only some small step and certainly does "solve" supply chain issues just because it may have prevented this specific case.

by uecker 23d ago

orlp 22d ago

> If I look at actual incidence involving memory safety issues compared to supply chain issues in general, it is the later which is much a higher risk to me. Again, can you even just name a single supply chain attack that was *shipped* in Rust software? Against the thousands and thousands of known memory vulnerability bugs throughout time? > And yes, there were successful supply chain attacks on Rust developers, even just recently: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... despite this being a "solved" problem. No, your linked blog post predates the brand-new min-age requirement. The minimum age would have prevented it, since it was detected by AI within an hour. If anything it supports my point. Plus, as I already mentioned, that is a build.rs supply chain attack that targets developers, not shipped software.

uecker 22d ago
Well, the affected arrayref crate was downloaded 2k times. It is also not the first case. If AI magically finds all bugs in short time we have no problems anyhow. We also do not need Rust. A minimum age requirement is a good thing, but also only some small step and certainly does "solve" supply chain issues just because it may have prevented this specific case.