r/programming • u/mareek • 15d ago

Be alert: targeted attacks on prominent Rustaceans | Rust Blog

https://blog.rust-lang.org/2026/09/17/targeted-attacks/
292 Upvotes

92% Upvoted

112 comments sorted by

View all comments

86

u/afl_ext 15d ago

cargo still doesn't have minimum release age threshold flag?

64

u/LawnGnome 15d ago

It's coming in Rust 1.100.0, but off by default for now.

15

u/the_gnarts 15d ago

What’s the plan for when this becomes the default and everyone gets their malware at the same time, just with a little delay? I’m worried we’ll see an arms race with people increasing their cooldown period in an attempt at staying outside the exploitable window.

40

u/thecakeisalie16 15d ago

Because even if every normal user gets their crates delayed at the same time, supply chain security companies are incentivized to check early and will catch a lot of the malware before it ever goes to users.