4 ms·

Package managers that use git are less prone to this kinda of attack (goland, rust).

• steveklabnik 2y ago
  Cargo does not “use git.”
  • AnyTimeTraveler 2y ago
    What they meant was probably, that you have the option to rely entirely on using git repositories for your dependencies or even just paths to other projects on your disk. You can also setup your own dependency registry and only work with that.
    • steveklabnik 2y ago
      That is possible but it’s not the default and isn’t as nice as the default is.
  • 3836293648 2y ago
    Cargo absolutely uses git, or else we wouldn't've had that thing where setting it to use the cli git instead of some reimplementation lead to massive speedups
    • steveklabnik 2y ago
      What I mean is that it doesn’t use git as the source of truth for packages (unless you point at a git repo instead of crates.io). It does use a git repo for the index.