Post B6f95uIoUZy3hhkemW by thomask@social.octet-stream.net
 (DIR) More posts by thomask@social.octet-stream.net
 (DIR) Post #B6f95uIoUZy3hhkemW by thomask@social.octet-stream.net
       0 likes, 0 repeats
       
       Awesome, the min-publish-age #rustlang RFC was merged last week, for protecting yourself against freshly published malware updates. Always thought this was a very sensible idea. https://rust-lang.github.io/rfcs//3923-cargo-min-publish-age.html
       
 (DIR) Post #B6f95uZ7Vx0mWHNgCO by AMDmi3@fosstodon.org
       0 likes, 0 repeats
       
       @thomask seconded, I closely watch this rfc too. For now it's a huge pain to do this manually, like with dependabot+cooldown (which doesn't update transitive depends anyway), or cargo update in a branch then merge it in a week. Still this feels like a band aid, while a real solution would be something like a distributed code audit system. IIRC cargo-vet does something like that, but I haven't tried it yet.
       
 (DIR) Post #B6f95upQXK3VKr0hcG by minoru@functional.cafe
       0 likes, 0 repeats
       
       @AMDmi3 See also cargo-crev. I used to actively review crates using it, but it's quite a chunk of work, I got tired and stopped.@thomask