News for hackers. Stuff that matters.

A comment on Rust Malware Staged on Crates.io. Parent comment

Re:Rust Malware Staged on Crates.io by binary132 on Friday August 25, 2023 @01:38PM (#37264629)
And yet hardly anyone ever makes this argument against sandboxing the code we download on demand every single day while browsing the internet.

I have started to believe we should think of open-source software as not so different, and sometimes even as less trustworthy in certain ways since we typically don’t sandbox it.

How many of your tools have telemetry? How many of your drivers do? How many download and execute stuff on the fly?

[ Parent | on HN ]
Re:Rust Malware Staged on Crates.io by tentacleuno on Sunday August 27, 2023 @04:36AM (#37280657)
That's completely different, though. JavaScript is sandboxed (and a lot of effort goes into ensuring that), while build-time macros (and runtime code) runs on the machine in an unrestricted manner. Not sure what your point is.
[ Parent | on HN ]