Rust

8208 readers

2 users here now

Welcome to the Rust community! This is a place to discuss about the Rust programming language.

Wormhole

!performance@programming.dev

Credits

The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)

founded 3 years ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

EdTheLegendary@programming.dev

torcherist@programming.dev

How Safe is the Rust Ecosystem? A Deep Dive into crates.io (mr-leshiy-blog.web.app)

submitted 7 months ago by codeinabox@programming.dev to c/rust@programming.dev

4 comments fedilink hide all child comments

cross-posted from: https://lemmy.bestiver.se/post/854816

Comments

top 4 comments

sorted by: hot top controversial new old

[–] collimated_thought@programming.dev 0 points 7 months ago

Professional software development needs to include a software Bill of Materials to help track and manage things like this. https://www.cisa.gov/sbom

[–] IanTwenty@piefed.social 0 points 7 months ago

It would be good to know how these figures compare to e.g. pypi, npm.

[–] FizzyOrange@programming.dev 0 points 7 months ago (1 children)

Yeah unfortunately these numbers don't really allow any conclusions to be drawn at all.

Also they're not really related to supply chain security which is more about deliberate subterfuge. I think the interesting stat there would be how many authors are being trusted typically for each crate.

[–] MoSal@programming.dev 0 points 7 months ago

I have the feeling that this wasn't even done properly (e.g. checking default versions only). Using downloads alone is also not a good filter.

I may give this some time tomorrow and provide my own numbers.