News for hackers. Stuff that matters.

A comment on Malicious Rust crate Arrayref runs a build-time payload. Parent comment

Re:Malicious Rust crate Arrayref runs a build-time payload by dwattttt on Thursday August 20, 2026 @04:17PM (#49379670)
Add more and more to a standard library, and you're going to start losing your "works everywhere".
[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by pjmlp on Thursday August 20, 2026 @05:26PM (#49380499)
Naturally there is a balance, still I think Java, .NET, Python, Go, Smalltalk, manage quite well, while having subsets to slim down when needed for specific deployment scenarios like embedded devices.
[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by kelnos on Friday August 21, 2026 @01:25AM (#49384142)
It's interesting that you include Java in there, as I've worked on some pretty bog-standard Java code bases where the dependency tree didn't look all that different from a cargo project's.
[ Parent | on HN ]
Re:Malicious Rust crate Arrayref runs a build-time payload by pjmlp on Friday August 21, 2026 @02:13AM (#49384401)
It starts by those that reach out for Log4J, when java.util.logging.Logger already does the job.

Guava for whatever cool reason, and so on.

[ Parent | on HN ]