Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Thursday, 05-Jun-2025 20:09:28 JST Rich Felker

   • 0xC0DEC0DE07E8

   @c0dec0dec0de @hipsterelectron The solution is not prompting for trust. The solution is not making an automated dependency fetching system that requires trust.

   • Embed this notice
     0xC0DEC0DE07E8 (c0dec0dec0de@hachyderm.io)'s status on Thursday, 05-Jun-2025 20:26:06 JST 0xC0DEC0DE07E8

     in reply to

     @dalias @hipsterelectron yeah, cargo chaining out into the horizon and saying, “all the light touches, you must *directly* trust” is no way to do things.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 05-Jun-2025 21:59:17 JST Rich Felker

     in reply to

     • 0xC0DEC0DE07E8

     @c0dec0dec0de @hipsterelectron Hot take that shouldn't be:

     If you're automatically fetching build dependencies in any way not controlled by the user or an agent they've designated, the only acceptable behavior is:

     (1) matching exact verifiable hashes for versions vetted by the authors of the dependent software, not version inequalities, and

     (2) ensuring that no code from those deps is run with with any access to the build host (so, either no code at all, or code in a language without host bindings or properly sandboxed).