4 ms·
The chances of cargo update pulling in some updated dependency which is now compromised with malware is low. The chances of a compromised dependency getting pas
by flooow 2y ago
The chances of cargo update pulling in some updated dependency which is now compromised with malware is low. The chances of a compromised dependency getting past `cargo-audit` are low. The chances of compromised code causing measurable harm are low. The repercussions for me publishing compromised code are low. The effort I would have to expend to manually check the code is high.
So yes, I `cargo update`.
- jcgrillo 2y agoI do too, but I wonder if there's a way we can make it tractable to shoulder the responsibility of maintaining our dependency graphs? More: [1]. [1] https://news.ycombinator.com/item?id=39832559 https://news.ycombinator.com/item?id=39832559