Supply chain attack on arrayref : rust@programming.dev

Supply chain attack on arrayref (blog.rust-lang.org)

submitted 2 weeks ago by cm0002@europe.pub to c/rust@programming.dev

5 comments fedilink hide all child comments

all 5 comments

sorted by: hot top controversial new old

[–] treadful@lemmy.zip 5 points 2 weeks ago

ugh

Guess it was just a matter of time.

[–] chickenf622@sh.itjust.works 4 points 2 weeks ago (1 child)

Reminder to have minimum ages for update releases to help avoid these exact kinds of attacks. I do like 3 days which is probably overkill.

hideshow 2 child comments

[–] naonintendois@programming.dev 2 points 2 weeks ago (2 children)

How do you set that up?

parent

hideshow 4 child comments

[–] chickenf622@sh.itjust.works 5 points 2 weeks ago

I'm not a rust user but it looks like the feature is in their unstable branch https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-ag. Also looks like someone made a crate to do that called cargo-cooldown. These supply chain attacks have been more frequent only recently so a lot of ecosystems are still working on implementing this kind of feature.

parent

[–] blazebra@programming.dev 1 point 2 weeks ago

Configure your updater and use exact or semi-exact versions.

parent