Re:The Tor Project is switching to Rust
by uecker on Saturday December 13, 2025 @02:50AM
(#46252883)
The distribution I use already has limited security updates for Rust: https://www.debian.org/releases/trixie/release-notes/issues.... which reduces my security. The cargo supply chain issues are also very obvious, I am far more worried about this than I ever will be about memory safety, but hopefully tor reduces its reliance on random dependencies.
[ Parent
| on HN ]
Re:The Tor Project is switching to Rust
by steveklabnik on Saturday December 13, 2025 @10:38AM
(#46255297)
I find that surprising given that Debian breaks Rust programs up into individual apt packages, but ultimately, other distros do not have this issue. It’s also about userspace programs and not the kernel, which does not use external packages and so sidesteps this completely.
Debian forky has Rust in the kernel on by default.
Re:The Tor Project is switching to Rust
by uecker on Saturday December 13, 2025 @11:15AM
(#46255614)
I guess the want to be able to update individual libraries to provide security updates.
Re:The Tor Project is switching to Rust
by steveklabnik on Saturday December 13, 2025 @12:59PM
(#46256474)
Right, from my understanding, Debian was packaging Rust programs in the same way as C ones. So they’d update the individual library and it should be all good. They deduplicated all of the dependencies in their trees.
This seems reasonable to me. If you have a tarmaggeedon, you update one library instead of thousand of packages. Although I am not sure how well this can work in Rust with monomorphization.