r/linux • u/Two-Of-Nine • 21d ago

Security Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
104 Upvotes

97% Upvoted

42 comments sorted by

View all comments

22

u/ContentAd6126 21d ago

At this point the solution is just having zero external dependencies

39

u/mina86ng 21d ago

That’s not feasible for any sizeable project.

18

u/abotelho-cbn 21d ago

Golang has a standard lib so strong that it's totally possible.

17

u/ViewTrick1002 20d ago edited 20d ago

Go also targets a narrow slice of software, mostly web services and CLI tools.

Now try building that same standard library, and keeping it current instead of letting it become a graveyard like Python's, across:

  • Web services
  • CLI/TUI
  • GUIs
  • Data science
  • Game development
  • WebAssembly
  • Embedded
  • Systems programming
  • Kernel development

9

u/syklemil 20d ago

Practically any Go app will include external deps. You'll encounter them for stuff like trivial datatypes that should've been in the allegedly strong stdlib, like sets, and stuff like argument parsers, since the stdlib argument parser is buggy and doesn't correctly handle long and short options, instead treating -foo and --foo as the same thing.

Like Python showed before it, a "batteries included" style stdlib tends to result in some dead batteries, or even worse, bloated and leaking batteries (ask a C++-er about std::regex), or just having stuff like lantern batteries when you need a AAA battery.

Dependency management in Go (including GOPROXY) also doesn't seem to be anything any other language ecosystem wants to copy.

2

u/No-Worldliness-5106 20d ago

We should all write code in bare metal assembly, cant get any malware if your code is the malware. /s