Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Rust crate Arrayref runs a build-time payload

safedep.io

Post reply on HN
Print view View original

31–40 of 529 posts

Re: Malicious Rust crate Arrayref runs a build-time payload

#31

Post by weinzierl »

rvz wrote: post #18
tsimionescu wrote: post #12

> arrayref is a small crate of four macros. Why do so many languages fall into this horrible practice?

The languages that have a poor standard library support have this issue and other languages encourage you to import tons of libraries to fix the problem. This is why Javascript and Typescript suffer from this the most and has little to nothing to do with "popularity" and likely 9/10 of these npm packages import an external library. Golang on the other-hand is just as popular and has a stronger standard library which…

Rich official standard library vs "import tons of libraries" are not the only two options.

Java's standard library had arguably also been poor for a very long time and "import tons of libraries" just had not been practical for most of that time because the tooling and ecosystem for that did not exist yet.

The solution was apache-commons and guava. Two large libraries with everything the developers heart desired and well maintained by large organizations.

For Rust be probably will never have anything exactly like that because requirements from no-std development to fully fledged backend service are too diverse, but there is still room for a small number of well maintained backed by reputable developers convenience libraries in my opinion.

Re: Malicious Rust crate Arrayref runs a build-time payload

#32

Post by bryanlarsen »

rvz wrote: post #18
tsimionescu wrote: post #12

> arrayref is a small crate of four macros. Why do so many languages fall into this horrible practice?

The languages that have a poor standard library support have this issue and other languages encourage you to import tons of libraries to fix the problem. This is why Javascript and Typescript suffer from this the most and has little to nothing to do with "popularity" and likely 9/10 of these npm packages import an external library. Golang on the other-hand is just as popular and has a stronger standard library which…

I've never seen a non trivial Python or Go project without external dependencies. The dependency tree of comparable Go and Rust projects seem comparable, IMO.

Re: Malicious Rust crate Arrayref runs a build-time payload

#33

Post by fidotron »

Doing software development outside of strict containerization, at the very least, looks increasingly prone to disaster.

Yes, we can argue about the culture of package management (as some of us have with especially npm from day one), but it's done, and your colleagues or AI sidekicks cannot be trusted not to download whatever and try to build and run it. All you can do is limit the effective blast radius.

Re: Malicious Rust crate Arrayref runs a build-time payload

#34

Post by irishcoffee »

wasmperson wrote: post #27
tsimionescu wrote: post #12

> arrayref is a small crate of four macros. Why do so many languages fall into this horrible practice?

There was a recent talk which explored this question (Dependency Cultures, by Richard Feldman): https://www.youtube.com/watch?v=E82ly38YEEQ Summary: it's cultural. Rust likely inherited the practice from Nodejs, who inherited it from Ruby. I think in Rust online spaces in particular there is also this undercurrent of "you're not smart enough to use certain parts of the language, so download libraries that handle that…

[flagged]

Re: Malicious Rust crate Arrayref runs a build-time payload

#35

Post by wasmperson »

rvz wrote: post #18
tsimionescu wrote: post #12

> arrayref is a small crate of four macros. Why do so many languages fall into this horrible practice?

The languages that have a poor standard library support have this issue and other languages encourage you to import tons of libraries to fix the problem. This is why Javascript and Typescript suffer from this the most and has little to nothing to do with "popularity" and likely 9/10 of these npm packages import an external library. Golang on the other-hand is just as popular and has a stronger standard library which…

I don't think this is true. People like to scapegoat the JS standard library but in reality most JS implementations have pretty featureful standard libraries, especially browsers. I've never felt the need to use any third-party libraries in the javascript projects I've worked on (except for maybe `ws`).

Re: Malicious Rust crate Arrayref runs a build-time payload

#36

Post by ajross »

christophilus wrote: post #9

Rust seems barely better than Node in this regard. Go or .Net or anything with a robust standard library seems like the way to go for most projects.

Cargo (and PyPI) is undeniably better than NPM, which is just shockingly bad for cultural reasons. Yet it's not safe, and it's subject to the same class of exploit, as we're seeing.

Indeed, the solution is to get away from the wild soup of author-managed dependencies and go with something with an audited collection of software that is maintained by separate human beings from the known-vulnerable hackers writing the software.

And indeed Go and .NET and Java all qualify. But the gold standard here is Debian and all its downstreams.

Re: Malicious Rust crate Arrayref runs a build-time payload

#37

Post by fukaiall »

rvz wrote: post #18
tsimionescu wrote: post #12

> arrayref is a small crate of four macros. Why do so many languages fall into this horrible practice?

The languages that have a poor standard library support have this issue and other languages encourage you to import tons of libraries to fix the problem. This is why Javascript and Typescript suffer from this the most and has little to nothing to do with "popularity" and likely 9/10 of these npm packages import an external library. Golang on the other-hand is just as popular and has a stronger standard library which…

Can’t agree more. If you take security seriously, you should consider using Go.

Re: Malicious Rust crate Arrayref runs a build-time payload

#38

Post by ecshafer »

These very small dependencies that are then later causing issues either due to malicious nature or incompetence, have become pervasive in computing (for some reason). I think that these should be less of an issue now than ever. Outside of the largest, most critical dependencies, you really shouldn't be pulling in small libraries anymore. Just generate the code via AI. AI is not great at large scale programming I think, but its amazing at snippets of code. Something I ran into recently, I needed to use FFT2 on some matrices, and what I was using didn't have an existing solution. Converting some numpy fft2 tests to my target language, and having a full native implementation of fft2, and an accompanying test suite so it will behave exactly like numpy fft2. A few minutes and a few thousand lines of code later, I have a trusted implementation. Saves me an external dependency, some weird glue code, and an attack vector.

Re: Malicious Rust crate Arrayref runs a build-time payload

#39

Post by superxpro12 »

wasmperson wrote: post #27
tsimionescu wrote: post #12

> arrayref is a small crate of four macros. Why do so many languages fall into this horrible practice?

There was a recent talk which explored this question (Dependency Cultures, by Richard Feldman): https://www.youtube.com/watch?v=E82ly38YEEQ Summary: it's cultural. Rust likely inherited the practice from Nodejs, who inherited it from Ruby. I think in Rust online spaces in particular there is also this undercurrent of "you're not smart enough to use certain parts of the language, so download libraries that handle that…

i'd like to welcome you to the hell that is c/c++ dependency management. Make? cmake? qmake? conf? autoconf? configure? autotools? submodules??? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Re: Malicious Rust crate Arrayref runs a build-time payload

#40

Post by josephg »

irishcoffee wrote: post #34
wasmperson wrote: post #27

Earlier quoted context omitted.

There was a recent talk which explored this question (Dependency Cultures, by Richard Feldman): https://www.youtube.com/watch?v=E82ly38YEEQ Summary: it's cultural. Rust likely inherited the practice from Nodejs, who inherited it from Ruby. I think in Rust online spaces in particular there is also this undercurrent of "you're not smart enough to use certain parts of the language, so download libraries that handle that…

[flagged]

> Rust is very much a schlong-measuring contest

What? Its just a programming language. Go dependency free if you want. Or vendor everything. Nobody is forcing you to pull in 3rd party dependencies.

Post reply on HN