Ah I see /r/rust is having another "are lots of deps bad thread." And no sorry cargo-crev is not a solution. Coming from a position of "I don't trust anyone's code" is such a crap world view. "I trust people to do the right thing unless proven otherwise" is how society works.
-
-
I really should have put a disclaimer here with a big asterisk "for deps" Really it's more like you inviting someone to hang out at your house and not fuck things up, not locking your car.
-
Well, a crate can execute arbitrary code at build time: with a lot of tools and CLIs storing authentication keys or other sensitive data in home directories by default, the amount of bad stuff a rogue dependency could do is huge.
- 9 more replies
New conversation -
-
-
I think cargo-crev MAY be a partial solution, not by "that reputable person reviewed it, so Now its safe", but by making more people actually read open source code, kind of by gameification.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.