News for hackers. Stuff that matters.

A comment on Rust Dependencies Scare Me. Parent comment

Re:Rust Dependencies Scare Me by blub on Saturday May 10, 2025 @03:36PM (#43948261)
People are paid to work on standard libraries and there’s a whole process behind developing and releasing this software.

Tokio on the other hand is the library whose maintainer decided to download a binary blob during build: https://github.com/tokio-rs/prost/issues/562 https://github.com/tokio-rs/prost/issues/575

Good luck catching such issues across dozens of crates.

[ Parent | on HN ]
Re:Rust Dependencies Scare Me by simonask on Sunday May 11, 2025 @02:30AM (#43951847)
The issue you linked is a perfect example in support of my argument. Lots of people noticed the problem, and it was quickly rectified.
[ Parent | on HN ]