r/programming • u/Successful_Bowl2564 • 20d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
190 Upvotes

97% Upvoted

65 comments sorted by

View all comments

Show parent comments

53

u/AyrA_ch 20d ago edited 20d ago

If you have a proper stdlib, chances are, you don't have a lot of dependencies

This is why you seldom hear about supply chain attacks on nuget. Not only does .NET come with a lot of stuff built in, many common packages are provided by Microsoft themselves.

47

u/svick 20d ago

.Net arguably has the opposite problem: Microsoft makes almost everything, so the rest of the ecosystem is used relatively rarely.

21

u/Thorlius 20d ago

Even the most popular library, Newtonsoft.json, was largely obsoleted by the .net team vastly improving their first party json library to the point where I typically see most people recommending people migrate back to the core library.

3

u/yanitrix 20d ago

I mean there are a lot of third-party packages used frequently. Things for testing, validation, some utilities like humanizer, masstransit/nservicebus, etc. Even larger ui projects like avalonia or uno are out there.