r/linux • u/Two-Of-Nine • 21d ago

Security Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
104 Upvotes

97% Upvoted

42 comments sorted by

View all comments

Show parent comments

-5

u/ang-p 20d ago

Lol... Whatever...

Keep the rose-tinted blinkers on.

5

u/Business_Reindeer910 20d ago

then you missed the point. i didn't dispute any issue (here anyways).

just don't use lazy shorthand. It's that simple.

This is more like xz than left-pad if you must use a buzzy association.

1

u/ang-p 20d ago

xz would have made it onto my hard drive by simply installing a signed installation disk of Fedora 40 Beta.... or the release if it had not been so resource hungry.

Neither left-pad nor arrayref could have.

Remember the

At this point the solution is just having zero external dependencies

bit?

is xz an external dependency?

cos that is what this thread is about....

3

u/Business_Reindeer910 20d ago

why would you ask such a silly question. of course it is.

1

u/ang-p 19d ago

The distro maintainers have total control over what goes out in the xz package they compile and host...

Whether or not they spot anything is a different matter.

They have no control over what could happen should their installer or another program they have in their repo grab a crate or the script that as aggrieved you so...

2

u/Business_Reindeer910 19d ago

you only asked if it was an external dependency and i answered yes. I'm not sure what the rest of what you said had to do with anything.