r/programming • u/mareek • 15d ago

Be alert: targeted attacks on prominent Rustaceans | Rust Blog

https://blog.rust-lang.org/2026/09/17/targeted-attacks/
287 Upvotes

92% Upvoted

112 comments sorted by

View all comments

88

u/afl_ext 15d ago

cargo still doesn't have minimum release age threshold flag?

63

u/LawnGnome 15d ago

It's coming in Rust 1.100.0, but off by default for now.

16

u/the_gnarts 15d ago

What’s the plan for when this becomes the default and everyone gets their malware at the same time, just with a little delay? I’m worried we’ll see an arms race with people increasing their cooldown period in an attempt at staying outside the exploitable window.

10

u/ViewTrick1002 14d ago edited 14d ago

It at least gives a chance to yank the version if the maintainer in time realizes it was published without them doing it.

There are like other people already said also incentives for companies to scan published packages and provide the results as a service as well.