worik
Born on November 09, 2014•5801 Karma
It can happen to anyone
The world economy is not a zero sum gain, we all do better when we do better
Cooperate with China, love and cherish them.
Unlike us of European heritage, they are not imperialistic
Get over yourselves!
Even a small rust programme can end up importing hundreds of crates. For many applications you need to investigate and verify your dependencies.
A substantialstandard library, the hypothesis is, will vastly reduce the number of sources you need to trust
It is early days for this, it is not to be trusted yet.
2. It is not crates.io specifically that is the problem. It is the concept of using many imports that all need verifying (my original statement here)
If fully auditing a collection of deps is the goal, it seems that could be accomplished by maintaining a list of repos and trusted commit hashes?
I guess I'm wondering whether there's some incremental solution that fits better with how the rest of the ecosystem works?
EDIT: just saw reference to cargo-vet, very cool! Thanks Colin.
The problem was ignored, perhaps?
Not every project is vulnerable, but many systems programming tasks are
I have encounted it
> are Rust developers going to seriously entertain an alternative "standard library" curated by one developer.
No. Absolutely not
But this is a start. Join the effort. Help them
Argumentum ad hominem, yuk
> the fundamental mistake of assuming that they’re trustworthy and we’d trust them no questions asked.
The author makes no such assumption, it is entirely your decision
> this repo is 100% AI slop,
That is an exaggeration. It is coded with AI help, as is almost everything these days
Agree, or disagree, that an anemic standard library is a problem, and crates.io is a glaring security risk and a looming catastrophe Kerkour is doing something about it
This is a start
It is one repo to trust, rather than hundreds
That is the reason
Strong words. Care to back them up?
IMO you are either honest or you are not
This ban is security theater, virtue signaling, again
I started out looking for lightweight X-Windows solutions, for the LLM and me to use. Cutting a long and frustrating story short I settled on SDL2 Rust wrapper
But what a PITA X-Windows is (e.g. need Wayland for some things, but does not work well for others), and my goal is an appliance, not an app.
So in a moment of insight I spent an afternoon getting SDL2 to draw on the Framebuffer and dispensed with X entirely
I highly recommend this approach. Life is so much easier without X-Windows