Earlier quoted context omitted.
You will have lots of dead code in your build. That dead code might have "dead dependencies" - transitive dependencies of its own, that it pulls in even though they are not actually used in the parts of the crate you care about. In the worst case, you can also have "undead code" - event handlers, hooks, background workers etc that the framework automatically registers and runs and that will do something at runtime, w…
Libraries like Guava and Commons don't have transitive dependencies - they are self contained except for other parts of the same library.
Incident Report: CVE-2024-YIKES
101–110 of 187 posts
Re: Incident Report: CVE-2024-YIKES
#102Re: Incident Report: CVE-2024-YIKES
#103Earlier quoted context omitted.
To be really sure it downloads, curl -k | sudo bash
`curl -k | sudo bash | yes` for good measure, otherwise it might hang.
Re: Incident Report: CVE-2024-YIKES
#104Earlier quoted context omitted.
> But for a long time (and maybe even still), a hacker creed was "move fast and break things." Was it? I thought Zuckerberg coined this horrible phrase.
Joel Spolsky. https://www.joelonsoftware.com/2000/04/06/things-you-should-...
Re: Incident Report: CVE-2024-YIKES
#105Re: Incident Report: CVE-2024-YIKES
#106Earlier quoted context omitted.
Yeah that's great. I love that plugging in the USB device from the phishing site is, itself, another attack vector...
I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one. I know we're not in the era…
Re: Incident Report: CVE-2024-YIKES
#107Earlier quoted context omitted.
`curl -k | sudo bash | yes` for good measure, otherwise it might hang.
If you really want to make sure that it's the right thing (because piping to sudo bash is risky), make sure the URL starts with "pastebin", or ends in ".tk", or is an IP address.
Re: Incident Report: CVE-2024-YIKES
#108Re: Incident Report: CVE-2024-YIKES
#109Earlier quoted context omitted.
Crates has also been making efforts to include rust sec, but in addition to the above I would like the community to shy away from many small dependencies to a few larger ones just as tokio has
Contrary to what the article here presents, Rust does not have a culture of microlibraries like NPM does. The author and their LLM are cargo-culting a criticism of Rust made by people whose only experience is with the Node ecosystem. The Rust stdlib may not be especially "wide" compared to languages like Python, but it is quite deep, with the objective of making it so that you don't feel the need to publish single-pu…