Skip Navigation
Jump
Rust has a HUGE supply chain security problem | Sylvain Kerkour | July 2, 2024
  • @FizzyOrange My point is that regardless of whether it's "blessed" by the Rust project, your only guarantee of maintenance is only that there are developers or other companies motivated to maintain the project. That also applies to individual parts of the standard library.

    Just like with the non-blessed versions, you need to pay attention to who actually maintains it, and guess whether this crate or feature will be maintained in the long run.

    1
  • Jump
    Rust has a HUGE supply chain security problem | Sylvain Kerkour | July 2, 2024
  • @FizzyOrange And a lot of crates you would want to see "blessed", are already in the Rust cookbook: https://rust-lang-nursery.github.io/rust-cookbook/

    1
  • Jump
    Rust has a HUGE supply chain security problem | Sylvain Kerkour | July 2, 2024
  • @FizzyOrange the Rust project is not an organisation you have a contract with. The only guarantee of maintenance you get are that of the MIT and Apache licenses.

    0
  • Jump
    Rust has a HUGE supply chain security problem | Sylvain Kerkour | July 2, 2024
  • @FizzyOrange@programming.de It's shown in the "owners".

    Regarding the crates that should be "officially sanctionned", what would this mean besides a fancy badge?

    1
  • Jump
    Rust has a HUGE supply chain security problem | Sylvain Kerkour | July 2, 2024
  • @FizzyOrange @ericjmorey The Regex crate is already part of the rust-lang organisation on GitHub. I don't know what you are asking for.

    2
  • Jump
    Are there FLOSS-friendly versions of YubiKey?
  • (Disclaimer: I work there)

    Check out @nitrokey. we make Open Source software and hardware security keys that have pretty similar functionality with Yubikeys.

    #Fido #PGO and in progress #PIV

    16