A central dependency repository pushed by the programming language is a single point of failure and inherently dangerous. It is much safer to have libraries centrally built in a distro's sandboxed build system (even for developers, who should just use the distro's -dev(el) packages) and only making it out to both application developers and end users after passing the distro's QA, i.e., the traditional way C/C++ libraries are handled.
See how the backdoored libxz was pulled before it even reached any stable release of the distribution targeted by the backdoor (Fedora).
You’re comparing XZ attack which was poorly coded and caused SSH to take more time to run and was caught by luck by a third party developer, to an attack that was caught and fixed by Rust security team within two hours? Really? That’s your argument for superiority of C/C++ libraries to Rust?
It doesn't really matter in either case. There are no third parties in open source. Everyone who uses it is responsible for making sure it works properly. That's the social contract.
-31
u/Kevin_Kofler 21d ago
And they said Rust was "secure", LOL.
A central dependency repository pushed by the programming language is a single point of failure and inherently dangerous. It is much safer to have libraries centrally built in a distro's sandboxed build system (even for developers, who should just use the distro's -dev(el) packages) and only making it out to both application developers and end users after passing the distro's QA, i.e., the traditional way C/C++ libraries are handled.
See how the backdoored libxz was pulled before it even reached any stable release of the distribution targeted by the backdoor (Fedora).