Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by mort96 on Thursday April 23, 2026 @06:41PM (#47883165)

Rust and Cargo are, if not inseparable, at least tightly connected. Rust and Rust's stdlib are inseparable.

Cargo is modeled after NPM. It works more or less identically, and makes adding thousands of transient dependencies effortless, just like NPM.

Rust's stdlib is pretty anemic. It's significantly smaller than node's.

These are decisions made by the bodies governing Rust. It has predictable results.

[ Parent | on HN ]

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by nathanmills on Thursday April 23, 2026 @10:01PM (#47884624)

ohh noo, the devs gave users a choice instead of forcing their hand..

[ Parent | on HN ]

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by mort96 on Friday April 24, 2026 @02:55AM (#47886576)

Design decisions have predictable consequences. Large masses of people, who make up an ecosystem like the that of a programming language community, respond predictably to their environment. Each individual programmer has a choice, sure, but you can't just "individual responsibility" your way out of the predictable consequences of incentive structures.

[ Parent | on HN ]

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by array_key_first on Tuesday April 28, 2026 @12:22AM (#47930424)

Rust's stdlib is fine, it's similar to C++ and C++ never had this problem.

It's just that it you give developers tools, they will absolutely abuse them to the highest extent. The problem with cargo is it's too good, so of course devs are gonna be pulling hundreds of dependencies. It's also why things like Claude Code have so much potential for shitty outcomes. Developers are lazy to the n-th degree. In fact, being a developer is predicated on being lazy. Laziness is the whole motivation behind software!

[ Parent | on HN ]