News for hackers. Stuff that matters.

A comment on Rust Dependencies Scare Me. Parent comment

Re:Rust Dependencies Scare Me by uecker on Friday May 09, 2025 @10:36PM (#43942801)
That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically link to the right libraries instead of vendoring the code. Then the library can be updated once. IMHO this is the only reasonable approach.
[ Parent | on HN ]
Re:Rust Dependencies Scare Me by simonask on Saturday May 10, 2025 @03:06AM (#43943766)
It's trivial to see on crates.io whether a crate is unmaintained.
[ Parent | on HN ]
Re:Rust Dependencies Scare Me by uecker on Saturday May 10, 2025 @07:05AM (#43944734)
Maybe if it is completely unmaintained, but this is not enough to solve the problem and maybe also not really the point.
[ Parent | on HN ]
Re:Rust Dependencies Scare Me by shwouchk on Saturday May 10, 2025 @01:56PM (#43947555)
is it trivial to see if a third level dependency is unmaintained?
[ Parent | on HN ]