Re:Malicious Rust crate Arrayref runs a build-time payload
by bryanlarsen on Thursday August 20, 2026 @01:39PM
(#49377733)
I expected somebody to pull out an example "disproving" my point. It wouldn't be hard. I can point out rust projects that have a ton of external dependencies, and then point at similar projects with very few.
But a Python example doesn't really count, in my mind -- Python is pre-GitHub so tends to have small numbers of large external dependencies, like C++ and other older languages.
Re:Malicious Rust crate Arrayref runs a build-time payload
by QuadmasterXLII on Thursday August 20, 2026 @01:56PM
(#49377940)
If a python example doesn't count, why were your two example languages python and go?
But yeah, small number of large dependencies is the way to go.
Re:Malicious Rust crate Arrayref runs a build-time payload
by bryanlarsen on Thursday August 20, 2026 @07:50PM
(#49381873)
Replying to the sentence "The dependency tree of comparable Go and Rust projects seem comparable, IMO." with a Python example seems pretty odd.
candle, the most popular rust ml library I found in a cursory search, has 119 for cpu only, and 150 to bring in CUDA.
I guess it's taste whether that's comparable
this would have been a way more satisfying dunk if nvidia hadn't split the cuda functionality needed by pytorch into 19 (!) packages on pypi but such is life.