this post was submitted on 20 Aug 2026
89 points (100.0% liked)

Rust

8247 readers
11 users here now

Welcome to the Rust community! This is a place to discuss about the Rust programming language.

Wormhole

!performance@programming.dev

Credits

  • The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)

founded 3 years ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
EdTheLegendary@programming.dev
torcherist@programming.dev
89
Supply chain attack on arrayref (blog.rust-lang.org)
submitted 6 days ago by Gobbel2000@programming.dev to c/rust@programming.dev
22 comments fedilink hide all child comments
 

If you recently used Cargo, make sure your system didn't get infected. Here is another article with a little more info: https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack

you are viewing a single comment's thread
view the rest of the comments
[–] sik0fewl@piefed.ca 1 points 5 days ago (1 children)

In reality it very rarely happens that native binaries are needed for Java. I’m not even sure what libraries might use them nowadays - I would guess mostly commercial closed source.

I don’t think it’s “infinitely worse”, but it does mean you require builds for whatever platform you are on or you need to manually build it from source as a separate project.

[–] badmin@lemmy.today 2 points 5 days ago

JVM, ELF, Mach-O,.... binaries are infinitely worse when the attack vector is "compromised dev machine".

I'm not sure how anyone would even try to argue against that.