Fixing Rust's supply chain security: The good, the bad and the ugly

Last week, Rust was hit with a supply chain attack. Fortunately, within ~110 minutes, the 9 backdoored packages were removed, great job the Rust Security Response Team! Unfortauntely, it was

Last week, Rust was hit by a supply chain attack that reached packages that are downloaded more than 1,000,000 times per day. Fortunately, within ~110 minutes, the 9 backdoored packages were removed, great job the Rust Security Response Team! Unfortauntely, it was mostly avoidable and there is nothing preventing it to happen again (actually there probably is many other malicious packages on crates.io that just haven't been detected yet). I've spent a lot of time working on supply chain security (https://kerkour.com/rust-crate-backdoor from 2021,…

saved by

• Mukul A

related reading

• A half-hour to learn Rustfasterthanli.me
• Patterns for Defensive Programming in Rust | corrode Rust Consultingcorrode.dev
• We should all be using dependency cooldownsblog.yossarian.net
• Rust Language Cheat Sheetcheats.rs
• Defining A Software Supply Chain Security Platform & Exploring New Techniques, Part 2softwareanalyst.substack.com
• How to Learn Rustgist.github.com
• Master Hexagonal Architecture in Rusthowtocodeit.com
• Why Rust - Rust for C-Programmersrust-for-c-programmers.com
• Semantic Versioning - Rust Project Primerrustprojectprimer.com
• The Great Refactor | IFPifp.org
• Software Supply Chain Security (Part 1)softwareanalyst.substack.com
• First thoughts on Rust vs OCamlblog.darklang.com