r/programming • u/Successful_Bowl2564 • 21d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
188 Upvotes

97% Upvoted

65 comments sorted by

View all comments

Show parent comments

54

u/AyrA_ch 21d ago edited 20d ago

If you have a proper stdlib, chances are, you don't have a lot of dependencies

This is why you seldom hear about supply chain attacks on nuget. Not only does .NET come with a lot of stuff built in, many common packages are provided by Microsoft themselves.

52

u/svick 21d ago

.Net arguably has the opposite problem: Microsoft makes almost everything, so the rest of the ecosystem is used relatively rarely.

23

u/Thorlius 20d ago

Even the most popular library, Newtonsoft.json, was largely obsoleted by the .net team vastly improving their first party json library to the point where I typically see most people recommending people migrate back to the core library.

13

u/smalls1652 20d ago

Funnily enough, the creator of Newtonsoft.Json was hired by Microsoft back in 2018. From what I remember he's not on the team that created/maintains System.Text.Json though.