Re:Malicious Rust crate Arrayref runs a build-time payload
by kibwen on Friday August 21, 2026 @03:20AM
(#49384874)
> the fact that `go build` can easily be run in off-line mode and doesn't execute any code other than the go toolchain itself
You can trivially run Cargo in offline mode, via the --offline flag. Nothing about this capability, in either Go or Rust, results in a more particularly trustworthy ecosystem.
You can trivially run Cargo in offline mode, via the --offline flag. Nothing about this capability, in either Go or Rust, results in a more particularly trustworthy ecosystem.