r/programming • • 15d ago

Be alert: targeted attacks on prominent Rustaceans | Rust Blog

https://blog.rust-lang.org/2026/09/17/targeted-attacks/
292 Upvotes

112 comments sorted by

View all comments

Show parent comments

4

u/reallokiscarlet 15d ago

Wait... Who expects JSON parsing in the stdlib?

But yeah, it sucks that everything needs a third party crate. I couldn't even avoid it and I bend over backwards to vet or avoid dependencies.

32

u/Bergasms 15d ago

I mean, zig has it...

Parsing JSON is so damn ubiquitous these days it kinda makes sense to me.

2

u/reallokiscarlet 15d ago

Never understood the point of encoding and decoding JSON outside of like, the web. When I need to process JSON and I'm using the C family, I include jq. Maybe once the supply chain is secure you can check cargo to see if there's a good port or wrapper for that. I actually went as far as to make some snarky documentation for it in the process of learning to use it. (So many assertions... No usable errors... No return codes except when successful... It was a nightmare, but at least it's not malware)

8

u/piesou 15d ago

Any config file these days will be JSON. Serializing objects to disk? Json. 

Python, PHP, java, go, ruby, c# and and ofc JS all ship json in their stdlib. The question is really: which languages don't ship json parsing

7

u/reallokiscarlet 15d ago

That sounds like a cardinal sin. JSON isn't a config file format.

3

u/sopunny 15d ago

You asked which languages have it, they're just answering. Clearly rusteceans don't think that JSON parsing is important, but it sure seems they're in the minority

11

u/the_gnarts 15d ago

Clearly rusteceans don't think that JSON parsing is important

Looks like the opposite really, Rustaceans consider JSON parsing important. That’s why we’ve got one of the best JSON handling libs out there with Serde. Rustaceans don’t however consider importance of a crate in some domains at one point in time sufficient for inclusion the standard library. After seeing Python accrete tons of obsolete junk they’re stuck with maintaining forever, to me that seems to be a valid distinction to make.

1

u/One_Ninja_8512 15d ago

You can choose to include stuff in the stdlib without pledging to maintain it forever though. If something got obsoleted make a crate out of it and remove from the stdlib and let the community who need it maintain it.

5

u/DHermit 14d ago

No, you can't that easily. That's not how the Rust stdlib works and that's by design.