literature.cafe

516 readers
12 users here now
(and anyone else, really)

This is a general special interest lemmy instance focusing on lovers of all things pertaining to reading and writing and all of the people that enjoy it as well as fandoms and niches that exist within reading circles. We federate with other instances, with our local communities being focused primarily on the above.

If you want to federate a new community, go to lemmyverse.net and copy a link to a community and paste it into the search bar. Be patient!

Also, consider installing instance assistant to better navigate lemmy and find communities better! Find links to download them here: firefox, chrome, edge

Instance Rules
  1. Keep it cozy. (No -isms, bigotry, gatekeeping, or general disrespect. Just be nice!)
  2. Please, no visual porn. (Smut and discussion of smut is OK as long as it is tagged as NSFW.)
  3. No spam.
  4. Be mindful of other instance rules.
  5. Keep self-promo to a minimum.
  6. Tag AI generated content as such.
  7. Please avoid piracy.
Server Info

Registration is open with human approval, just to make sure there's no bots afoot. Approval should take less than a day (and are sometimes near instant)

Please check your spam folder for an email from noreply@literature.cafe if you are having difficulty finding email confirmation.

Community creation is enabled. When creating new communities please be mindful of the instance focus.

If you have any issues or concerns, please message an admin

Fediseer Guarantees

For those visiting from other instances, we have a community directory to make finding communities easier: !411@literature.cafe

We also have alternative lemmy UIs to use for those who want them.

A familiar UI - old.literature.cafe

Photon - ph.literature.cafe

Tesseract (photon fork with more multimedia focused features) - t.literature.cafe

Donations are greatly appreciated and go entirely to server costs but are not required.

List of Patrons Daily Uptime Ratio Weekly Uptime Ratio Average Response Time

founded 1 year ago
ADMINS
gabe
Arthur
admin
listing: all - local
search
1
10
Rust has a HUGE supply chain security problem | Sylvain Kerkour | July 2, 2024 (kerkour.com)
 
 

cross-posted from: https://programming.dev/post/16349359

July 2, 2024

Sylvain Kerkour writes:

Rust adoption is stagnating not because it's missing some feature pushed by programming language theory enthusiasts, but because of a lack of focus on solving the practical problems that developers are facing every day.

... no company outside of AWS is making SDKs for Rust ... it has no official HTTP library.

As a result of Rust's lack of official packages, even its core infrastructure components need to import hundreds of third-party crates.

  • cargo imports over 400 crates.

  • crates.io has over 500 transitive dependencies.

...the offical libsignal (from the Signal messaging app) uses 500 third-party packages.

... what is really inside these packages. It has been found last month that among the 999 most popular packages on crates.io, the content of around 20% of these doesn't even match the content of their Git repository.

...how I would do it (there may be better ways):

A stdx (for std eXtended) under the rust-lang organization containing the most-needed packages. ... to make it secure: all packages in stdx can only import packages from std or stdx. No third-party imports. No supply-chain risks.

[stdx packages to include, among others]:

gzip, hex, http, json, net, rand

Read Rust has a HUGE supply chain security problem

Submitter's note:

I find the author's writing style immature, sensationalist, and tiresome, but they raise a number of what appear to be solid points, some of which are highlighted above.

2
19
Rust has a HUGE supply chain security problem | Sylvain Kerkour | July 2, 2024 (kerkour.com)
 
 

July 2, 2024

Sylvain Kerkour writes:

Rust adoption is stagnating not because it's missing some feature pushed by programming language theory enthusiasts, but because of a lack of focus on solving the practical problems that developers are facing every day.

... no company outside of AWS is making SDKs for Rust ... it has no official HTTP library.

As a result of Rust's lack of official packages, even its core infrastructure components need to import hundreds of third-party crates.

  • cargo imports over 400 crates.

  • crates.io has over 500 transitive dependencies.

...the offical libsignal (from the Signal messaging app) uses 500 third-party packages.

... what is really inside these packages. It has been found last month that among the 999 most popular packages on crates.io, the content of around 20% of these doesn't even match the content of their Git repository.

...how I would do it (there may be better ways):

A stdx (for std eXtended) under the rust-lang organization containing the most-needed packages. ... to make it secure: all packages in stdx can only import packages from std or stdx. No third-party imports. No supply-chain risks.

[stdx packages to include, among others]:

gzip, hex, http, json, net, rand

Read Rust has a HUGE supply chain security problem

Submitter's note:

I find the author's writing style immature, sensationalist, and tiresome, but they raise a number of what appear to be solid points, some of which are highlighted above.

view more: next ›