Re:Malicious Rust crate Arrayref runs a build-time payload
by kergonath on Thursday August 20, 2026 @02:19PM
(#49378235)
> We also have the classic example of PHP with numerous not safe stdlib ways to use mysql.
I think it goes without saying that emulating PHP is rarely a good decision.
Re:Malicious Rust crate Arrayref runs a build-time payload
by VorpalWay on Thursday August 20, 2026 @06:19PM
(#49381046)
Don't forget C++ where large parts of the standard library are unusable (regex is slow and unfixable) or soft deprecated (dont use iostreams for formatting, use std::format, etc).
No, I prefer what rust is doing. It suits a system programming language. Which is what Rust is.
Re:Malicious Rust crate Arrayref runs a build-time payload
by pjmlp on Friday August 21, 2026 @02:15AM
(#49384411)
Regex does the job for most business software, iostreams is alright, using them since 1993, std::format is cool provided one has control over their compiler version,...
Re:Malicious Rust crate Arrayref runs a build-time payload
by VorpalWay on Friday August 21, 2026 @06:49AM
(#49386268)
Regex is absolutely not suitable for most use cases that I have come across. Iostreams formatting is awful, especially if you care about internationalization (which is very common).
Not sure what the issue with std::format would be here, you would have to elaborate. Obviously you need to specify a minimum version to have support for it at all.
We also have the classic example of PHP with numerous not safe stdlib ways to use mysql.
To me the answer is still to vendor your dependencies and don't be on the bleeding edge of updates unless you're willing to invest the time into validating them.