Just tried building a rust project using cargo and it started pulling and building 385 dependency packages without any confirmation prompt. This is insane and super not secure. How are rust devs ok with this?
EDIT: to make it clear, my problem is that it didn't stop for confirmation. This is not ok. I thought NPM was bad but this is insane.
This entry was edited (5 days ago)
Bubu
in reply to Sos Sosowski • • •Lot's of discussion about this here: users.rust-lang.org/t/yet-anot…
I didn't know it was so bad 😔.
Yet another npm supply-chain attack. Is Cargo any safer?
The Rust Programming Language ForumSos Sosowski
in reply to Bubu • • •Bubu
in reply to Sos Sosowski • • •I don't see how you could meaningfully consent to this though?
You either just blanket accept "yes, do your thing, trust all these 400 external packages" or you are back to reviewing them one-by-one. Am I missing something?
Sos Sosowski
in reply to Bubu • • •Bubu
in reply to Sos Sosowski • • •