Ah I see /r/rust is having another "are lots of deps bad thread." And no sorry cargo-crev is not a solution. Coming from a position of "I don't trust anyone's code" is such a crap world view. "I trust people to do the right thing unless proven otherwise" is how society works.
-
Show this thread
-
Replying to @mgattozzi
I agree with your general take, but trusting people to do the right thing still doesn't mean I'm going to leave them unattended with my laptop signed in with a terminal to my production database open. (But cargo-crev is still not a solution)
2 replies 0 retweets 3 likes -
Replying to @sgrif
I really should have put a disclaimer here with a big asterisk "for deps" Really it's more like you inviting someone to hang out at your house and not fuck things up, not locking your car.
1 reply 0 retweets 0 likes -
Replying to @mgattozzi @sgrif
Well, a crate can execute arbitrary code at build time: with a lot of tools and CLIs storing authentication keys or other sensitive data in home directories by default, the amount of bad stuff a rogue dependency could do is huge.
2 replies 0 retweets 1 like
You can use linker attributes to execute arbitrary code before main
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.