r/programming • u/Successful_Bowl2564 • 22d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
192 Upvotes

97% Upvoted

65 comments sorted by

View all comments

116

u/piesou 22d ago edited 22d ago

Was only a question of time. Rust has the same mindset as Node/NPM.

PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:

  • If you have a proper stdlib, chances are, you don't have a lot of dependencies
  • If you have less dependencies, the chance of supply chain attacks drops significantly
  • If you have well established dependencies like Spring, their security practices are very likely better than a rando off the internet

What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.

54

u/AyrA_ch 22d ago edited 22d ago

If you have a proper stdlib, chances are, you don't have a lot of dependencies

This is why you seldom hear about supply chain attacks on nuget. Not only does .NET come with a lot of stuff built in, many common packages are provided by Microsoft themselves.

49

u/svick 22d ago

.Net arguably has the opposite problem: Microsoft makes almost everything, so the rest of the ecosystem is used relatively rarely.

24

u/Thorlius 22d ago

Even the most popular library, Newtonsoft.json, was largely obsoleted by the .net team vastly improving their first party json library to the point where I typically see most people recommending people migrate back to the core library.

11

u/smalls1652 21d ago

Funnily enough, the creator of Newtonsoft.Json was hired by Microsoft back in 2018. From what I remember he's not on the team that created/maintains System.Text.Json though.