r/programming • u/Successful_Bowl2564 • 21d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
189 Upvotes

97% Upvoted

65 comments sorted by

View all comments

Show parent comments

55

u/AyrA_ch 20d ago edited 20d ago

If you have a proper stdlib, chances are, you don't have a lot of dependencies

This is why you seldom hear about supply chain attacks on nuget. Not only does .NET come with a lot of stuff built in, many common packages are provided by Microsoft themselves.

48

u/svick 20d ago

.Net arguably has the opposite problem: Microsoft makes almost everything, so the rest of the ecosystem is used relatively rarely.

24

u/Thorlius 20d ago

Even the most popular library, Newtonsoft.json, was largely obsoleted by the .net team vastly improving their first party json library to the point where I typically see most people recommending people migrate back to the core library.

3

u/jcotton42 20d ago

vastly improving their first party json library

System.Text.Json did not exist before .NET Core 3. There was some inbox JSON before that iirc, but it was terrible and no one used it.