Some background on this: Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm (there is https://crates.io/crates/left_pad if you're wondering). This of course raises the question: what if someone puts some malware in a crate? Cargo itself has an OK security (and working on more end-to-end integrity checks), so it's unlikely that someone will inject malware…
Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm This of course raises the question: what if someone puts some malware in a crate? Do decentralized web of trust schemes actually work? What are the precedents? AFAIK, only centralized webs of trust work, and even those still leak around the edges and take some degree of active policing to defend. Basicall…
How can you claim that? Looking at most tech we have today, it becomes readily apparent that most technology needs multiple iterations before achieving wide adoption. Web of trust is no exception.
The lack of a widely-adopted precedent implying that some tech is forever poor is a sloppy conclusion to make.