Re:Crev: dependency vetting with a web of trust
by eridius on Friday January 04, 2019 @05:20PM
(#18828258)
> Rust is not a sandbox language. Even the "safe" subset of the language is still just about preventing bugs, but nowhere near a watertight sandbox required to protect programmers and users from straight-up malware running in their own program.
Not only that, but even just the act of building a dependency is unsafe as dependencies can specify build scripts (which is just Rust code that's compiled and executed prior to building the crate).
Not only that, but even just the act of building a dependency is unsafe as dependencies can specify build scripts (which is just Rust code that's compiled and executed prior to building the crate).