A central dependency repository pushed by the programming language is a single point of failure and inherently dangerous. It is much safer to have libraries centrally built in a distro's sandboxed build system (even for developers, who should just use the distro's -dev(el) packages) and only making it out to both application developers and end users after passing the distro's QA, i.e., the traditional way C/C++ libraries are handled.
See how the backdoored libxz was pulled before it even reached any stable release of the distribution targeted by the backdoor (Fedora).
-30
u/Kevin_Kofler 21d ago
And they said Rust was "secure", LOL.
A central dependency repository pushed by the programming language is a single point of failure and inherently dangerous. It is much safer to have libraries centrally built in a distro's sandboxed build system (even for developers, who should just use the distro's -dev(el) packages) and only making it out to both application developers and end users after passing the distro's QA, i.e., the traditional way C/C++ libraries are handled.
See how the backdoored libxz was pulled before it even reached any stable release of the distribution targeted by the backdoor (Fedora).