It is a joy but makes it far too easy to pull in dependencies. And then Build.rs also runs. From a supply chain security perspective, Rust scares me.
back
1 comments
I'm fully supportive to sandbox build.rs for that reason, but the same concern applies to pretty much everything in your computer so I'm not worried as much. In the other words, that risk is currently constant with respect to the choice of language.
It's not constant, most C projects don't have anywhere near the number of library dependencies seen in your typical cargo project. From a supply chain attack perspective, Rust and Node promote ecosystems that are total disasters.
Most software projects are not written in C. Conversely C would be used for projects where C would be less annoying than alternatives, and that condition largely precludes projects with many required dependencies. And every language-level package manager, not just that of Rust and Node, would be a disaster from the supply chain attack perspective---it can even be said that C is suffering from the huge amount of supply chain attacks in spite of the lack of good language-level package manager.