Earlier quoted context omitted.
> The original claim is that “pretty much no one” reads any of their dependencies, No the claim is that very few people read the dependencies[1] enough to catch a malicious piece of code . And I stand by it. “Many eyeballs” is a much weaker guarantee when people are just doing “go to definition” from their code (for instance you're never gonna land on a build.rs file this way, yet they are likely the most critical pi…
> No the claim is that very few people read the dependencies[1] enough to catch a malicious piece of code. You’re shifting around between reading enough to catch any issue (which I could easily do if a vulnerability was right there staring at me when I follow symbol) to catching all issues (like your comment about build.rs.) Please stick with one and avoid moving goal posts around. There exists a category of dependen…
If anything, having access to the source code gives you an illusion of security, which is probably the worse place to be in.
The worse ecosystem when it comes to supply chain attacks is arguably the npm one, yet there anyone can see the source and there are almost two orders of magnitude more eyeballs.