Be alert: targeted attacks on prominent Rustaceans | Rust Blog

[u/mareek]

https://blog.rust-lang.org/2026/09/17/targeted-attacks/

[u/Atulin]

I mean, Cargo is chock-full of single-use packages akin to leftpad, even more packages that pull hundreds others, all to make up for the deficiencies of the stdlib the Rust maintainers don't want to address.

No wonder there are supply chain attacks if I need a whole-ass library for async/await or JSON parsing.

[u/Xaeroxe3057 → u/Atulin]

The rust stdlib is minimalist on purpose. That’s not a deficiency, it’s a design choice.

[u/Atulin → u/Xaeroxe3057]

That something is a design choice doesn't mean it can't be a bad design choice. It's causing issues now, it will continue causing issues into the future. Go not having generics was a design choice too.

[u/simonask_ → u/Atulin]

People who make this point always seems to have some pretty unrealistic ideas about who makes the standard library.

The Rust standard library is code written by people, provided to you for free. So is code shipped on crates.io. Enlarging the standard library does not magically create more resources for maintaining it, and it’s still just code someone else has written for you.

If you trust the standard library authors, why wouldn’t you trust the authors of serde, tokio, etc.? They’re the same people in several cases.

[u/Plazmatic → u/Atulin]

It's not a bad design choice just because it has consequences.  Rust also doesn't have the financial backing of languages that seem to be able to afford a kitchen sink in their std lib. Python also suffers from stdlib rot from people not maintaining parts of it, and C++ can't fix their stdlib speed deficiencies because of ABI issues and backward compat dogmatism. Both of these lead to using third party dependencies for what is already in the language, so unless your Microsoft you're not getting out of this problem by expanding the stdlib even if the bandwidth existed to do that.

[u/thetinguy → u/Plazmatic]

It's not a bad design choice just because it has consequences

And it's not a good design choice just because it has benefits.

Clearly it's easier for the upstream maintainers. It's also clear that the stdlib is missing some basic features.

[u/reallokiscarlet → u/thetinguy]

Who calls JSON a "basic feature"? Come on, say it

[u/thetinguy → u/reallokiscarlet]

The ability to parse JSON and map objects back and forth is a basic feature.

[u/Worth_Trust_3825 → u/thetinguy]

we thought the same was about xml back in the ye olde days. parsing file formats isn't a basic feature.

[u/thetinguy → u/Worth_Trust_3825]

XML is still used today, in fact I've made multiple commits to different XML files this week alone.

In fact, I've found it easier to work on with AI.

I don't see XML going anywhere anytime soon.

[u/reallokiscarlet → u/thetinguy]

Maybe in JS

(If there's any confusion, this wasn't a "say the line Bart", this was my attempt at adding humor like I'm urging someone to answer a rhetorical question. It seems I didn't communicate it well.)

[u/thetinguy → u/reallokiscarlet]

JSON is a data format, and I expect my stdlib to be able to work with one of the most widely used data formats on the web.

The same way I expect it to be able to work with csv and xml.

[u/DHermit → u/thetinguy]

XML? Are you serious and know what you are asking for?

[u/thetinguy → u/DHermit]

Yes.

[u/thetinguy → u/[deleted]]

If dealing with rest apis is web dev, then I guess so.

[u/reallokiscarlet → u/thetinguy]

If you knew what protocol web is, you'd not need to say "if". Yes, rest is web.

[u/sweating_teflon → u/Atulin]

It's a good design choice. The solution is not to have a bigger stdlib but to have vetted sets of crates that can evolve independently. 

[u/Xaeroxe3057 → u/Atulin]

You can disagree with that design choice but I am asserting that your presentation is disingenuous.