Rust has a HUGE supply chain security problem
kerkour.com
This post is part of my Summer of Rust 2024 series: weekly (or more) quickies about how to write great Rust code so you will be ready to rock at the end of the summer and find a new exciting job 🤘 Dont forget to Subscribe (Email & RSS) "If

July 2, 2024

Sylvain Kerkour writes:

Rust adoption is stagnating not because it’s missing some feature pushed by programming language theory enthusiasts, but because of a lack of focus on solving the practical problems that developers are facing every day.

… no company outside of AWS is making SDKs for Rust … it has no official HTTP library.

As a result of Rust’s lack of official packages, even its core infrastructure components need to import hundreds of third-party crates.

  • cargo imports over 400 crates.

  • crates.io has over 500 transitive dependencies.

…the offical libsignal (from the Signal messaging app) uses 500 third-party packages.

… what is really inside these packages. It has been found last month that among the 999 most popular packages on crates.io, the content of around 20% of these doesn’t even match the content of their Git repository.

…how I would do it (there may be better ways):

A stdx (for std eXtended) under the rust-lang organization containing the most-needed packages. … to make it secure: all packages in stdx can only import packages from std or stdx. No third-party imports. No supply-chain risks.

[stdx packages to include, among others]:

gzip, hex, http, json, net, rand

Read Rust has a HUGE supply chain security problem

Submitter’s note:

I find the author’s writing style immature, sensationalist, and tiresome, but they raise a number of what appear to be solid points, some of which are highlighted above.

  • calcopiritus@lemmy.world
    0·
    3 months ago

    It is true that having many dependencies is supply chain attack. However, this is the result of combining the following:

    • The UNIX mantra of “do one thing, and do it well”
    • The more things a program does, the more intuitive and useful it is.

    If you want to keep the 2, you’re gonna need a lot of dependencies. To significantly decrease the amount of dependencies you’re gonna need to drop one of those, there’s no other way around it.

    If you wanna know what happens when you drop the UNIX mantra look at any discussion about systemd.

    If you drop the second one, everybody would have to bring their own glue. Making computers only accessible to Linux gurus that master the “|” operator and study CLI program arguments in their spare time.

    I don’t know why this article focuses on rust specifically. Every language has this problem. And cargo itself has many ways to mitigate this.

    • Lockfiles & caches: prevents unwanted version updates.
    • Custom registries: You don’t have to use crates.io, that’s just the default. Set up your own registry with only whitelisted crates.
    • Use GitHub instead of a registry: cargo has great support for this. If you want your dependencies to always match their GitHub repos, just download from GitHub and compile your own.
    • Dark Arc@social.packetloss.ggEnglish
      01·
      3 months ago

      Java and Python projects can be based almost entirely on the standard library because there’s so much in there (or packages with minimal/no third party dependencies).

      C++ it’s not uncommon for the entire code base or the majority of the code base to be internal (and maybe make use of the standard library or a library under the boost umbrella).

      The “every language” is largely a “languages that became popular in the NodeJS era” issue.