chickenf622 comments on Supply chain attack on arrayref

[–] chickenf622@sh.itjust.works 4 points 1 month ago (3 children)

Reminder to have minimum ages for update releases to help avoid these exact kinds of attacks. I do like 3 days which is probably overkill.

permalink

fedilink

source

hideshow 3 child comments

[–] naonintendois@programming.dev 2 points 1 month ago (2 children)

How do you set that up?

permalink

fedilink

source

parent

hideshow 2 child comments

[–] chickenf622@sh.itjust.works 5 points 1 month ago

I'm not a rust user but it looks like the feature is in their unstable branch https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-ag. Also looks like someone made a crate to do that called cargo-cooldown. These supply chain attacks have been more frequent only recently so a lot of ecosystems are still working on implementing this kind of feature.

permalink

fedilink

source

parent

[–] blazebra@programming.dev 1 point 1 month ago

Configure your updater and use exact or semi-exact versions.

permalink

fedilink

source

parent