News for hackers. Stuff that matters.
Re:Making Rust supply chain attacks harder with Cackle by cmrdporcupine on Friday October 13, 2023 @10:05AM (#37870776)
Yes, that's fair, Maven did start with a better story than others in terms of authenticity of sources, etc.

Crates.io doesn't even have the concept of an organizational namespace. It's ridiculous.

But Maven still has the broader cultural problem of automatic dep resolution: it's just too easy to go adding deps for every little utility and nifty function or feature or framework.

There are no comments on this comment yet.