I feel dumbfounded. All I've ever heard from rust users, is the equivalent of football fans running up, waving pendants in my face and screaming. So much so, that everything else said seems like the wild fantasies of "our team gonna win".

Then things like this appear:

https://www.phoronix.com/news/First-Linux-Rust-CVE

And I'm all warm and feeling schadenfreude.

To hear "yes, it's safer" and yet not "everyone on the planet not using rust is a moron!!!", is a nice change.

Frankly, the whole cargo side of rust has the same issues that node has, and that's silly beyond comprehension. Memory safe is almost a non-concern, compared to installing random, unvetted stuff. Cargo vet seems barely helpful here.

I'd want any language caring about security and code safety, to have a human audit every single diff, on every single package, and host those specific crates on locked down servers.

No, I don't care about "but that will slow down development and change!". Security needs to be first and front.

And until the Rust community addresses this, and its requirement for 234234 packages, it's a toy.

And yes, it can be done. And no, it doesn't require money. Debian's been doing just this very thing for decades, on a far, far, far larger scale. Debian developers gatekeep. They package. They test and take bug reports on specific packages. This is a solved problem.

Caring about 'memory safe!' is grand, but ignoring the rest of the ecosystem is absurd.

Debian has been doing this for decades, yes, but it is largely a volunteer effort, and it's become a meme how slow Debian is to release things.

I've long desired this approach (backporting security fixes) to be commercialized instead of the always-up-to-date-even-if-incompatible push, and on top of Red Hat, Suse, Canonical (with LTS), nobody has been doing it for product teams until recently (Chainguard seems to be doing this).

But, if you ignore speed, you also fail: others will build less secure products and conquer the market, and your product has no future.

The real engineering trick is to be fast and build new things, which is why we need supply chain commoditized stewards (for a fee) that will solve this problem for you and others at scale!

Not dismissing your point, but Looking at the article, it looks like it's in rust unsafe code. Which seems to me to be a point that the rest of the rust code is fine but the place where they turned off the static safety the language provides they got bit.

Um I doubt Debian maintainers look at every single line of code in the packages they maintain.

One might even call the rust community a “cargo cult”