Re:Malicious Rust crate Arrayref runs a build-time payload
by bryanlarsen on Thursday August 20, 2026 @10:25AM
(#49375017)
I've never seen a non trivial Python or Go project without external dependencies. The dependency tree of comparable Go and Rust projects seem comparable, IMO.
[ Parent
| on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload
by QuadmasterXLII on Thursday August 20, 2026 @12:06PM
(#49376543)
Pytorch has 9 transitive dependencies for cpu-only execution, or 29 to bring in cuda.
candle, the most popular rust ml library I found in a cursory search, has 119 for cpu only, and 150 to bring in CUDA.
I guess it's taste whether that's comparable
this would have been a way more satisfying dunk if nvidia hadn't split the cuda functionality needed by pytorch into 19 (!) packages on pypi but such is life.
Re:Malicious Rust crate Arrayref runs a build-time payload
by bryanlarsen on Thursday August 20, 2026 @01:39PM
(#49377733)
I expected somebody to pull out an example "disproving" my point. It wouldn't be hard. I can point out rust projects that have a ton of external dependencies, and then point at similar projects with very few.
But a Python example doesn't really count, in my mind -- Python is pre-GitHub so tends to have small numbers of large external dependencies, like C++ and other older languages.
Re:Malicious Rust crate Arrayref runs a build-time payload
by QuadmasterXLII on Thursday August 20, 2026 @01:56PM
(#49377940)
If a python example doesn't count, why were your two example languages python and go?
But yeah, small number of large dependencies is the way to go.
Re:Malicious Rust crate Arrayref runs a build-time payload
by bryanlarsen on Thursday August 20, 2026 @07:50PM
(#49381873)
Replying to the sentence "The dependency tree of comparable Go and Rust projects seem comparable, IMO." with a Python example seems pretty odd.
Re:Malicious Rust crate Arrayref runs a build-time payload
by QuadmasterXLII on Thursday August 20, 2026 @09:25PM
(#49382535)
Ok! I had parsed your comment wrong. I see now that you claimed that python and go projects always had at least one dependency, and that go and rust projects had similar dependency counts, but you were not claiming that python and rust had similar dependency counts. Thanks for clarifying, with that I agree my comment was not a good counterexample.