Kinda relevant, as I saw few comments about how safer languages are the solution. Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1]. [0] - https://github.com/c-skills/rust1 [1] - https://checkmarx.com/blog/over-170k-users-affected-by-attac...
I am very concerned about Rust. Rust’s “decision” to have a very slim standard library has advantages, but it severely amplifies some other issues. In Go, I have to pull in zero dependencies to make an HTTP request. In Rust, pulling reqwest pulls in at least 30 distinct packages ( https://lib.rs/crates/reqwest ). Date/time, “basic” base64, common hashing or checksums, etc, they all become supply chain vectors. The Ru…
You don't automatically download anything at build or install time, you just update your local source copies when you want to. Which to be clear I know means rarely.
It's 1970 all over again!