libs-team | rustsec | |
---|---|---|
13 | 33 | |
107 | 1,527 | |
1.9% | 1.4% | |
6.3 | 9.5 | |
3 months ago | 1 day ago | |
Rust | Rust | |
Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
libs-team
-
Error when using cxx to link a Rust-written library in a C++ project
In rust, both release and debug builds use a release version of the runtime. The bugs the debug version is meant to catch are much more difficult to hit in rust (often but not always requiring unsafe). There isn't currently a feature to use the debug runtime in rust-- you can only change C to match for those debug builds.
-
log is going to bump msrv to 1.60
Note that this has been discussed at length (and I do mean "at length") here: https://github.com/rust-lang/libs-team/issues/72
-
Why We Love Rust: Ferris Is Only Part Of It
The Compiler Team, especially the Diagnostics Working Group that improves compiler error messages. The Libs Team, for work on the contents of the standard library documentation
-
Rust in 2023: Growing Up
See https://github.com/rust-lang/libs-team/issues/72#issuecommen... for what I believe is an exhaustive list of possible ways of helping the situation.
-
time: MSRV policy is changing beginning 2023-07-01 to N-2 rustc versions
The point is how the MSRV of a popular crate affects this dynamic for other crates. For an even more extreme example than time, see here for libc, with many heavyweights offering opinions: https://github.com/rust-lang/libs-team/issues/72
-
What are binary crate MSRV policy best practices?
In case you haven't seen it yet, there is a very long discussion surrounding MSRV policy of the libc crate on rust-langs github repo. It's about a library, not a binary, but I think there's a lot of information in the thread, some of which will also apply to binaries.
-
(pre-announcing) clap 4.0, a Rust CLI argument parser
Would you mind sharing your use case for being stuck with a particular version of Rust and why you can't upgrade? In particular with the libs team: https://github.com/rust-lang/libs-team/issues/72
-
Azure CTO: “It's time to halt starting any new projects in C/C++ ”
Compare Stepanov's brilliant design of the STL to Rust's current reworking of their 'binary search api'. https://github.com/rust-lang/libs-team/issues/81
Maybe 'memory safety' isn't the most important thing in this world. To me, writing software that does useful things in the simplest and most correct way is what matters. I get the feeling it's harder to understand my program's correctness with Rust (I mean algorithmic correctness). The C++ standard library has time and space complexity for every algorithm. I'm not seeing that's the case with Rust (correct me if I'm wrong).
-
Is anyone actually stuck on an old version of Rust
There's also the pretty fundamental libc crate that wants to choose an MSRV policy and you can see the full discussion here: https://github.com/rust-lang/libs-team/issues/72
- For rust, I have never see a real world project contains million lines of code, nor more than 1000 components here.
rustsec
-
Rust Tooling: 8 tools that will increase your productivity
cargo-audit is a simple Cargo tool for detecting vulnerable Rust crates. You can install it with cargo install cargo-audit, use cargo audit and you’re done! Any vulnerable crates will appear below, like so:
-
Rust Offline?
Further we use cargo-auditable and cargo-audit as part of both our pipeline and regular scanning of all deployed services. This makes our InfoSec and Legal super happy since it means they can also monitor compliance with licenses and patch/update timings.
-
Sudo and Su Being Rewritten in Rust for Memory Safety
Yeah your decade old single header libs get so many audits by comparison.
https://github.com/RustSec/rustsec/tree/main/cargo-audit
https://mozilla.github.io/cargo-vet/
cargo is not npm
-
A CVE has been issued for hyper. Denial of Service possible
PSA: before filing CVEs for other people's projects, file an issue with https://rustsec.org instead
-
Should atomics be unsafe?
Historically, such serious bugs get communicated broadly and addressed very quickly via security advisory blog posts and on https://rustsec.org.
-
Rust from a security perspective, where is it vulnerable?
For known vulnerabilities we have the rustsec vulnerability database. You could have a look over there for inspiration. There's also the related cargo-audit for checking dependencies for known vulnerabilities.
-
capnproto-rust: out-of-bound memory access bug
Would be cool if this was also reported to https://rustsec.org/ that way cargo audit could pick up and alert the users about it.
-
`cargo audit` can now scan compiled binaries
P.S. I also made scanning binaries 5x faster in the latest release of cargo audit.
-
My Rust development workflow (after 3+ years)
Thanks to cargo and the community, project maintenance is straightforward in rust. You'll need to install cargo-outdated and cargo-audit:
-
Mental models for learning Rust
Use the automated tools to assist you in the maintenance of your projects: rustfmt, clippy, cargo update, cargo outdated and cargo-audit.
What are some alternatives?
awesome-rust - A curated list of Rust code and resources.
opensnitch - OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
meta-rust - OpenEmbedded/Yocto layer for Rust and Cargo
vulndb - [mirror] The Go Vulnerability Database
docs.rs - crates.io documentation generator
gosec - Go security checker
namespacing-rfc - RFC for Packages as Optional Namespaces
crates.io - The Rust package registry
sccache - Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage.
ripasso - A simple password manager written in Rust
sled - the champagne of beta embedded databases
advisory-db - Security advisory database for Rust crates published through crates.io