20
submitted 2 days ago by kbal@fedia.io to c/rust@programming.dev

estimated audit backlog: 67560 lines

I started learning rust. Worried about trusting all the various code that gets pulled in from the interwebs to compile the first example project in the book (which depends only on "rand" to get random numbers, which requires 8 different libraries), I installed "cargo vet" so that I'd at least know about it if I accidentally added things that haven't been vetted by anyone at all.

Doing this installed a further 200 crates, with no indication as to whether they have themselves been vetted by anyone or not, and tells me that half the ones I already had just from adding "rand" have not been vetted by anyone.

Anyway, I'm learning rust.

you are viewing a single comment's thread
view the rest of the comments
[-] kbal@fedia.io 1 points 1 day ago

One of the things I immediately liked about cargo is that (so far as I've seen thus far) the source is already there, without vendoring, in ~/.cargo/registry. In Debian, to get the source it's apt-get source $package and as an end user it's super easy to build things from those source packages if you want to.

this post was submitted on 17 Dec 2025
20 points (95.5% liked)

Rust

7586 readers
93 users here now

Welcome to the Rust community! This is a place to discuss about the Rust programming language.

Wormhole

!performance@programming.dev

Credits

  • The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)

founded 2 years ago
MODERATORS