flâneur

Fixing Rust's supply chain security: The good, the bad and the ugly

kerkour.com · 2,753 words · saved by 1 readers

Last week, Rust was hit with a supply chain attack. Fortunately, within ~110 minutes, the 9 backdoored packages were removed, great job the Rust Security Response Team! Unfortauntely, it was

Last week, Rust was hit by a supply chain attack that reached packages that are downloaded more than 1,000,000 times per day. Fortunately, within ~110 minutes, the 9 backdoored packages were removed, great job the Rust Security Response Team! Unfortauntely, it was mostly avoidable and there is nothing preventing it to happen again (actually there probably is many other malicious packages on crates.io that just haven't been detected yet). I've spent a lot of time working on supply chain security (https://kerkour.com/rust-crate-backdoor from 2021,…

saved by

related reading