- cross-posted to:
- kazkassukompais@group.lt
- lobsters@lemmy.bestiver.se
- cross-posted to:
- kazkassukompais@group.lt
- lobsters@lemmy.bestiver.se
If you recently used Cargo, make sure your system didn’t get infected. Here is another article with a little more info: https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack
That would be good but it’s not a magic solution to this problem. They would just move the exploit to runtime. Yeay you don’t get hacked if you compile and never run your program.
You can counter that there are some situations where the program is run sandboxed, e.g. if you’re compiling to WASI or microcontroller firmware or whatever. But those are a tiny minority of cases.
Good point. But hey, at least CI would be safer if nothing else and we’d raise the bar.