rustsec
rust
rustsec | rust | |
---|---|---|
33 | 2,686 | |
1,527 | 93,266 | |
1.6% | 1.4% | |
9.5 | 10.0 | |
5 days ago | 4 days ago | |
Rust | Rust | |
GNU General Public License v3.0 or later | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
rustsec
-
Rust Tooling: 8 tools that will increase your productivity
cargo-audit is a simple Cargo tool for detecting vulnerable Rust crates. You can install it with cargo install cargo-audit, use cargo audit and you’re done! Any vulnerable crates will appear below, like so:
-
Rust Offline?
Further we use cargo-auditable and cargo-audit as part of both our pipeline and regular scanning of all deployed services. This makes our InfoSec and Legal super happy since it means they can also monitor compliance with licenses and patch/update timings.
-
Sudo and Su Being Rewritten in Rust for Memory Safety
Yeah your decade old single header libs get so many audits by comparison.
https://github.com/RustSec/rustsec/tree/main/cargo-audit
https://mozilla.github.io/cargo-vet/
cargo is not npm
-
A CVE has been issued for hyper. Denial of Service possible
PSA: before filing CVEs for other people's projects, file an issue with https://rustsec.org instead
-
Should atomics be unsafe?
Historically, such serious bugs get communicated broadly and addressed very quickly via security advisory blog posts and on https://rustsec.org.
-
Rust from a security perspective, where is it vulnerable?
For known vulnerabilities we have the rustsec vulnerability database. You could have a look over there for inspiration. There's also the related cargo-audit for checking dependencies for known vulnerabilities.
-
capnproto-rust: out-of-bound memory access bug
Would be cool if this was also reported to https://rustsec.org/ that way cargo audit could pick up and alert the users about it.
-
`cargo audit` can now scan compiled binaries
P.S. I also made scanning binaries 5x faster in the latest release of cargo audit.
-
My Rust development workflow (after 3+ years)
Thanks to cargo and the community, project maintenance is straightforward in rust. You'll need to install cargo-outdated and cargo-audit:
-
Mental models for learning Rust
Use the automated tools to assist you in the maintenance of your projects: rustfmt, clippy, cargo update, cargo outdated and cargo-audit.
rust
-
Rust to .NET compiler – Progress update
> There are online Rust compilers and interpreters already if you just want to rapid prototype and develop ideas in Rust
You are responding to one of the key developers of Rust early on[1], who's been working with the language for 14 years at that point.
[1] https://github.com/rust-lang/rust/graphs/contributors?from=2... and he's still #16 in commits overall today, despite almost no activity on the rust compiler since 2014.
-
Create a Custom GitHub Action in Rust
If you haven't dipped your touch-typing fingers into Rust yet, you really owe it to yourself. Rust is a modern programming language with features that make it suitable not only for systems programming -- its original purpose, but just about any other environment, too; there are frameworks that let your build web services, web applications including user interfaces, software for embedded devices, machine learning solutions, and of course, command-line tools. Since a custom GitHub Action is essentially a command-line tool that interacts with the system through files and environment variables, Rust is perfectly suited for that as well.
-
Why Does Windows Use Backslash as Path Separator?
Here's an example of someone citing a disagreement between CRT and shell32:
https://github.com/rust-lang/rust/issues/44650
This in addition to the Rust CVE mentioned elsewhere in the thread which was rooted in this issue:
https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html
Here are some quick programs to test contrasting approaches. I don't have examples of inputs where they parse differently on hand right now, but I know they exist. This was also a problem that was frequently discussed internally when I worked at MSFT.
#include
-
I hate Rust (programming language)
> instead of choosing a certain numbered version of the random library (if I remember correctly) I let cargo download the latest version which had a completely different API.
Yeah, they didn't follow the instructions and got burned. I still think that multiple things went wrong simultaneously for that experience. I wonder if more prevalent uses of `#[doc(alias = "name")]` being leveraged by https://github.com/rust-lang/rust/pull/120730 (which now that I check only accounts for methods and not functions, I should get on that!) so that when changing APIs around people at least get a slightly better experience.
- Rust Weird Exprs
- Critical safety flaw found in Rust on Windows (CVE-2024-24576)
-
Unformat Rust code into perfect rectangles
Almost fixed the compiler: https://github.com/rust-lang/rust/pull/123325
-
Implement React v18 from Scratch Using WASM and Rust - [1] Build the Project
Rust: A secure, efficient, and modern programming language (omitting ten thousand words). You can simply follow the installation instructions provided on the official website.
-
Show HN: Fancy-ANSI – Small JavaScript library for converting ANSI to HTML
Recently did something similar in Rust but for generating SVGs. We've adopted it for snapshot testing of cargo and rustc's output. Don't have a good PR handy for showing Github's rendering of changes in the SVG (text, side-by-side, swiping) but https://github.com/rust-lang/rust/pull/121877/files has newly added SVGs.
To see what is supported, see the screenshot in the docs: https://docs.rs/anstyle-svg/latest/anstyle_svg/
-
Upgrading Hundreds of Kubernetes Clusters
We strongly believe in Rust as a powerful language for building production-grade software, especially for systems like ours that run alongside Kubernetes.
What are some alternatives?
opensnitch - OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
carbon-lang - Carbon Language's main repository: documents, design, implementation, and related tools. (NOTE: Carbon Language is experimental; see README)
vulndb - [mirror] The Go Vulnerability Database
zig - General-purpose programming language and toolchain for maintaining robust, optimal, and reusable software.
gosec - Go security checker
Nim - Nim is a statically typed compiled systems programming language. It combines successful concepts from mature languages like Python, Ada and Modula. Its design focuses on efficiency, expressiveness, and elegance (in that order of priority).
crates.io - The Rust package registry
Odin - Odin Programming Language
ripasso - A simple password manager written in Rust
Elixir - Elixir is a dynamic, functional language for building scalable and maintainable applications
advisory-db - Security advisory database for Rust crates published through crates.io
Rustup - The Rust toolchain installer