Re: Scanning the entire Ports tree for Rust vulns

On 10/05/2026 01:15, Daniel Engberg wrote:
> On 2026-05-09 23:25, Alan Somers wrote:
>> TLDR; It's possible to preemptively scan the whole ports tree for Rust
>> crates with known vulnerabilities, without building anything

[..]

>> [^1]: https://rustsec.org/
>> [^2]: https://rustsec.org/advisories/RUSTSEC-2024-0336.html
> 
> As much as I would like to say that's great I think we can more or less 
> conclude that security in ports tree as a whole is of very low priority 
> (you're beating a dead horse). It takes weeks/months to land fixes for 
> high profile libraries and/or applications. We don't even try to 
> deprecate unmaintained software, even if it has known vulns. Some 
> committers don't care because it "hurts"/"disables" one or many of their 
> ports. There's no evaluation of adding new software, "everything" gets 
> added, being very niche, dead for years or origin might call for extra 
> evaluation there are no concerns to mention a few topics. bofh@ made a 
> talk about this some other things several months ago and so far the 

Maybe in your world. I see it the other way around: ports are being 
removed without much thought, simply because the upstream project isn’t 
releasing new versions. Furthermore, I don’t think FreeBSD should be the 
one to decide whether users are allowed to shoot themselves in the foot 
or not. A lot of SW is still useful and, in some environments, secure 
even if it contains certain vulnerabilities. And some SW is 
irreplaceable. The dream of a repository without vulnerable software is 
a pipe dream.

Miroslav Lachman