Re: Concerns Regarding the Choice of Rust for the Xfce Wayland Compositor
Michael Wyraz <[email protected]> Wed, 17 Jun 2026 22:48:54 +0200
| Newsgroups | gmane.comp.desktop.xfce.devel.version4 |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============6888925676230297226==
Content-Type: multipart/alternative;
boundary="------------s0XIoXB4y0QDciFhO6vtWt2e"
Content-Language: en-US
This is a multi-part message in MIME format.
--------------s0XIoXB4y0QDciFhO6vtWt2e
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Hello,
>> The second concern is the supply chain risk from Cargo and crates.io.
>> Using Rust means pulling in a large number of external dependencies,
>> which introduces a significant attack surface that does not exist in
>> a pure C project.
>>
>
> This is absolutely true, and is the one and only thing that worries me
> about using Rust. I'm not sure what the solution is here, if there is
> one. Both smithay and gtk-rs pull in quite a lot of transitive
> dependencies, and there's not much that can be done about that. I
> think software ecosystems as a whole are only just starting to figure
> out what to do about supply chain issues around centralized dependency
> managers, and there's still a lot of work to be done to increase
> security and confidence.
I'm sure there is a way to pin versions (like a package.lock
equivalent). Why not use AI to do a full review of all dependencies on
every change and make this mandatory? I know, many OSS projects
discourage the usage of AI for development (e.g. for licensing reasons).
But using it for code review should be legally safe and brings the
ability to do extensive reviews with limited capacities.
Kind regards,
Michael.
--------------s0XIoXB4y0QDciFhO6vtWt2e
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<blockquote type="cite"
cite="mid:[email protected]">
<blockquote type="cite" id="qt" style="">
<p dir="auto">The second concern is the supply chain risk from
Cargo and crates.io. Using Rust means pulling in a large
number of external dependencies, which introduces a
significant attack surface that does not exist in a pure C
project.</p>
</blockquote>
<div><br>
</div>
<div>This is absolutely true, and is the one and only thing that
worries me about using Rust. I'm not sure what the solution is
here, if there is one. Both smithay and gtk-rs pull in quite a
lot of transitive dependencies, and there's not much that can be
done about that. I think software ecosystems as a whole are
only just starting to figure out what to do about supply chain
issues around centralized dependency managers, and there's still
a lot of work to be done to increase security and confidence.</div>
</blockquote>
<p>I'm sure there is a way to pin versions (like a package.lock
equivalent). Why not use AI to do a full review of all
dependencies on every change and make this mandatory? I know, many
OSS projects discourage the usage of AI for development (e.g. for
licensing reasons). But using it for code review should be legally
safe and brings the ability to do extensive reviews with limited
capacities.</p>
<p>Kind regards,</p>
<p>Michael.</p>
<p><br>
</p>
</body>
</html>
--------------s0XIoXB4y0QDciFhO6vtWt2e--
--===============6888925676230297226==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Xfce4-dev mailing list
[email protected]
https://mail.xfce.org/mailman/listinfo/xfce4-dev
--===============6888925676230297226==--