This time a popular crate "arrayref" was compromised, because it's second-degree transitive dependency "proc-macro1" was compromised.Was Cargo a mistake?https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
>>109611196> entire crate package system contains malwareWorth it for memory safety
>>109611210Even malware enjoys blazing speed and memory safety
>>109611196I imagine it's quite lucrative these days if you're a Rust developer to just develop some shitty library that 10-20 other libraries depend on, and then you just sell your Rust account credentials to these le Chinese haxors
>>109611196> upload random malware> get caught within the hour> crates team confirms that it was download by nobodyEpic supply chain attack.
>>109611196Pinned versions don't have this issue
>>109611263it's gets funnier.>got added to the advisory db in <40 minutes from publishing>no one would have even grabbed the compromised dep in that 40 minute window with `cargo install --locked` since it got to ZERO published `Cargo.lock` filesthis attack with ZERO victims was also the first incident concerning a crate with real dependants, so the "Another" from OP is a lie.still, the `build.rs` part of cargo was always the weak point in the tooling, and such an attack triggering an acceleration in shipping solutions around it is perfect, while still keeping the record of confirmed victims in the entirety of crates.io history at a fat ZERO.
>>109611491>it happened but nobody was affectedIt's a matter of time then
>>109611520>someone uploads malware to github>no one downloads it>GitHub detects malware within hour and bans user>it's a matter of time, Git has already fallen!
>>109611196YesGuix refuses to build most Rust packages unless they’re packaged properly for Guix, btw, because it correctly considers cargo wanting to pull arbitrary packages in at build time to be completely insane.
>>109611564retard
>>109611568Can you name any package manager(for any Linux distro or any language) that doesn't pull arbitrary packages in at build time?
>>109611568based stallman taking no BS when making guix
>>109611577Literally anything that handles reproducible builds properly
>>109611590Guix lead devs and rms are well known to not get along
If you are blindly using mystery box packages without verifying what they are actually doing you are not different than vibe coders.
>>109611577Guix. Like in the post you replied to. Or Nix, I assume. Deterministic and reproducible builds are the whole point. Pulling in arbitrary packages is insane and gets you exactly this kind of problem.
use case for relying on an insecure ecosystem?
>>109611709>>109611592>type install package>it downloads arbitrary dependencies you didn't ask for
>>109611520any day now
>>109611568the attack vector used was `build.rs`, a pre-build tool (for tasks like compiling C code).it can fork and run commands, and make TCP connections with ZERO grabbed dependencies already, since it's just rust code (like the entirety of zig tooling).and even if those capabilities were not in std (which would be contradictory to the common /g/eet tard complaint about std being "too small"), anyone can "extern" the needed functions from libc, or even call syscalls directly in `build.rs`, since you know, rust is a real system language.this is why the proposed non-tard solutions are about introducing workable sandboxing for the `build.rs`pre-step.and no, you can't not have `build.rs`, because that would make things infinitely worse, and explaining why shouldn't be needed if you're a non-tard.
>>109611592>>109611709"reproducible builds" alone doesn't handle build machine attacks retards.in fact, the signature of this very attack with ZERO victims was phoning home during build.
>>109612318You "reproducibly" generate malicious packages anyway lol.
>>109611520two more weeks!
Every library distribution system is vulnerable to supply chain attacks.
>>109611709cargo can also be made reproducible with a cargo.lock file thougheven npm can do that. the problem is you are still trusting rando package mantainers to not be malicious/retardedthis is an unsolvable problem, best you can do is have a trusted source audit the package which is what guix and other linux distros doin programming languages this is logistically impossible. the closest thing i have seen to this is odin lang which doesnt have a package manager at all and instead just gives you a very broad standard library and a handful of curated packages, which it can do because the language itself is heavily specialized around a niche (gamedev/graphics programming)
>>109613474also i believe golang used to also work this way but webdevs kept complaining they needed a package manager so the devs caved in but i am not 100% sure
>>109613474every single time there was a malicious package it was something that was relatively small (like left-pad) or a basic compression utility (like xz)both of these types of packages should be in the stdlib, like they are in Go.
>>109613523agreed but people are dumb as rocks man like look at is-odd package on npm, it has like 40 million downloadsthe goyim are trully despicable
>>109613496go modules were just URLs before getting a package manager. so all you needed was a DNS server to hack them lol
>>109611196i like to read when people are defending their cult in agony. thx for this thread OP!
C doesn't have shitty package managerC chads win again, yee-haw
>>109613496Go by default sets you up with a dependency version lock, meaning that you are in effect vendoring all your dependencies. There is no option to always update to latest. Then, because you have a strong stdlib like >>109613523 mentions, you have relatively few transitive dependencies (and THOSE are all vendored to specific versions too). It's pretty reasonable to read your dependencies if you really want to. So even if a low-level package with a lot of dependencies got compromised, the rate of damage would only be relative to the number of people who decide to re-vendor that specific package, and the damage would not spread transitively. Any package manager that, by default, keeps your deps at latest and allows that property to expand on a transitive basis is inviting problems to expand wildly out of control. It's not a good thing that you have to configure your package manager off of "grind my dick into a pulp" mode. Rust managed to catch this problem fast; awesome, great news. But the fact they caught it fast was because they built an auxiliary support system to guard against fundamental dangers in their ecosystem, and that auxiliary system happened to match favorably against the attempted exploit. If it didn't, the problem would be way worse, and Cargo's design would be at fault.
>>109611196Package managers are not—and should not be—build systems. As a build system Cargo is ludicrously terrible; I'd rather write my build system in batch script and use Wine to interpret it than use Cargo as a build system. As a package manager Cargo is less bad, but it does lack in security as no Cargo command is safe to run on untrusted code.
>>109613474Lock files do not guarantee reproducible builds, they only guarantee that the packages pulled by the lock file are the same—a package may use curl to pull something as part of its build. Packages may embed a timestamp, absolute path, or other kinds of environment-specific data into the binary. If the output of the build is not guaranteed to be bit identical then it is not a reproducible build.
>>109611196This cancer of demanding up-to-date dependencies has metastasizedWhat you should do when using third party libraries is take a single version of it, audit it, and integrated it into your project as a static library. If there's a security issue or something else that requires a newer version, you repeat the process or manually backport the security fix to it.Unfortunately as open source is an ideological failure, it has become increasingly difficult to do so due to dependencies of dependencies depending on ever larger projects and everything breaking constantly if it's not up-to-date due to awful programming practices where consistent and stable functionality and compatibility is seen as a flaw.
>>109611196>Was Cargo a mistake?absolutely. a programming language having its own specific package manager is possibly one of the worst ideas ever vomited up from the imagination of retards. >>109611568>it correctly considers cargo wanting to pull arbitrary packages in at build time to be completely insane.100% insane>>109612303>this is why the proposed non-tard solutions are about introducing workable sandboxing for the `build.rs`pre-step.and this is yet another reason why people think rust is just an embarrassing farce
>arrayref>246,327,884 Downloads all timehttps://crates.io/crates/arrayrefthe absolute state of this trash language
