Re:Making Rust supply chain attacks harder with Cackle
by cmrdporcupine on Friday October 13, 2023 @10:05AM
(#37870776)
Yes, that's fair, Maven did start with a better story than others in terms of authenticity of sources, etc.
Crates.io doesn't even have the concept of an organizational namespace. It's ridiculous.
But Maven still has the broader cultural problem of automatic dep resolution: it's just too easy to go adding deps for every little utility and nifty function or feature or framework.
Crates.io doesn't even have the concept of an organizational namespace. It's ridiculous.
But Maven still has the broader cultural problem of automatic dep resolution: it's just too easy to go adding deps for every little utility and nifty function or feature or framework.