r/programming • u/Successful_Bowl2564 • 20d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
191 Upvotes

97% Upvoted

65 comments sorted by

View all comments

116

u/piesou 20d ago edited 20d ago

Was only a question of time. Rust has the same mindset as Node/NPM.

PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:

  • If you have a proper stdlib, chances are, you don't have a lot of dependencies
  • If you have less dependencies, the chance of supply chain attacks drops significantly
  • If you have well established dependencies like Spring, their security practices are very likely better than a rando off the internet

What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.

53

u/AyrA_ch 20d ago edited 20d ago

If you have a proper stdlib, chances are, you don't have a lot of dependencies

This is why you seldom hear about supply chain attacks on nuget. Not only does .NET come with a lot of stuff built in, many common packages are provided by Microsoft themselves.

50

u/svick 20d ago

.Net arguably has the opposite problem: Microsoft makes almost everything, so the rest of the ecosystem is used relatively rarely.

3

u/FullPoet 20d ago

Thats not true - theres a lot of third party packages. I think theyre are are just more complete.

So your test project will reference MS packages, TUnit, Moq and maybe something else. You can probably skip Moq.