cross-posted from: https://lemmy.bestiver.se/post/854816
How Safe is the Rust Ecosystem? A Deep Dive into crates.io
https://mr-leshiy-blog.web.app/blog/crates_io_analysis/
https://mr-leshiy-blog.web.app/blog/crates_io_analysis/
cross-posted from: https://lemmy.bestiver.se/post/854816
5 Comments
collimated_thought@programming.dev · 8 pts · 220d
Professional software development needs to include a software Bill of Materials to help track and manage things like this. https://www.cisa.gov/sbom
FizzyOrange@programming.dev · 5 pts · 220d
Yeah unfortunately these numbers don't really allow any conclusions to be drawn at all.
Also they're not really related to supply chain security which is more about deliberate subterfuge. I think the interesting stat there would be how many authors are being trusted typically for each crate.
MoSal@programming.dev · 2 pts · 220d
I have the feeling that this wasn't even done properly (e.g. checking default versions only). Using downloads alone is also not a good filter.
I may give this some time tomorrow and provide my own numbers.
IanTwenty@piefed.social · 4 pts · 220d
It would be good to know how these figures compare to e.g. pypi, npm.
blazebra@programming.dev · 1 pts · 218d
I don’t think cargo-deny alone is enough. And many from Rust ecosystem thinks that if I specified version “1”, it will be enough forever. Many tools nowadays are installed by binstall, so binary will be older and older and won’t receive any updates.