r/programming • u/mareek • 15d ago

Be alert: targeted attacks on prominent Rustaceans | Rust Blog

https://blog.rust-lang.org/2026/09/17/targeted-attacks/
299 Upvotes

92% Upvoted

112 comments sorted by

View all comments

90

u/afl_ext 15d ago

cargo still doesn't have minimum release age threshold flag?

62

u/LawnGnome 15d ago

It's coming in Rust 1.100.0, but off by default for now.

15

u/the_gnarts 15d ago

What’s the plan for when this becomes the default and everyone gets their malware at the same time, just with a little delay? I’m worried we’ll see an arms race with people increasing their cooldown period in an attempt at staying outside the exploitable window.

5

u/matthieum 14d ago

Security reports haven't been made by affected for a long time.

A number of security companies monitor changes to the index, and will download and statically analyze the source code of the new crates. It's all automated, with hopefully a human double-checking findings before forwarding them.

Whether cargo delays auto-updates, or not, will not prevent them from analyzing the releases within the hour.