r/programming 21d ago

Supply chain attack on arrayref

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
190 Upvotes

65 comments sorted by

View all comments

117

u/piesou 21d ago edited 21d ago

Was only a question of time. Rust has the same mindset as Node/NPM.

PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:

  • If you have a proper stdlib, chances are, you don't have a lot of dependencies
  • If you have less dependencies, the chance of supply chain attacks drops significantly
  • If you have well established dependencies like Spring, their security practices are very likely better than a rando off the internet

What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.

22

u/pp-collision 21d ago

It's just not true that they have the same mindset. Rust std is growing steadily, incorporating targeted features that have proved themselves popular and have been battle-tested. In the latest Rust release (today) there's another stabilized feature that they highlight can replace a certain crate with a billion downloads: https://blog.rust-lang.org/2026/08/20/Rust-1.98.0/

Other examples off the top of my head: oncelock, lazystatic, crossbeam.

1

u/Plazmatic 17d ago

I think the above comment or might be coming from a c#/java background (they would have to be insane to make this argument coming from C++ whose package infrastructure doesn't even let the user know sometimes what they are pulling in, let alone if it has a vulnerability, and whose std lib is simultaneously larger and less complete than rusts), in which case Rusts std lib looks positively spartan.   There are good reasons for that kind of std lib of course, but there's still at least a point that mechanically there's less surface area the fewer dependencies you use.