91
Supply chain attack on arrayref (blog.rust-lang.org)
submitted 1 week ago by to c/rust@programming.dev
22 comments fedilink hide all child comments
 

If you recently used Cargo, make sure your system didn't get infected. Here is another article with a little more info: https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack

you are viewing a single comment's thread
view the rest of the comments
[–] 0 points 1 week ago (2 children)

I just wanted to ask, how do they build C libraries in JAVA world? And if the answer is they don't, they just ship binaries, then that's infinitely worse. And you just confirmed that's the case 😲😄.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    In reality it very rarely happens that native binaries are needed for Java. I’m not even sure what libraries might use them nowadays - I would guess mostly commercial closed source.

    I don’t think it’s “infinitely worse”, but it does mean you require builds for whatever platform you are on or you need to manually build it from source as a separate project.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •