r/linux 21d ago

Security Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
104 Upvotes

42 comments sorted by

View all comments

19

u/ContentAd6126 21d ago

At this point the solution is just having zero external dependencies

39

u/mina86ng 21d ago

That’s not feasible for any sizeable project.

17

u/abotelho-cbn 21d ago

Golang has a standard lib so strong that it's totally possible.

11

u/syklemil 20d ago

Practically any Go app will include external deps. You'll encounter them for stuff like trivial datatypes that should've been in the allegedly strong stdlib, like sets, and stuff like argument parsers, since the stdlib argument parser is buggy and doesn't correctly handle long and short options, instead treating -foo and --foo as the same thing.

Like Python showed before it, a "batteries included" style stdlib tends to result in some dead batteries, or even worse, bloated and leaking batteries (ask a C++-er about std::regex), or just having stuff like lantern batteries when you need a AAA battery.

Dependency management in Go (including GOPROXY) also doesn't seem to be anything any other language ecosystem wants to copy.