> Who is funding this security audit? Are folks supposed to volunteer their free time?

Same people who keep the whole rust project going, a lot of those are volunteers aren't they? Not mad to think they could do the same for core packages at least

▲

aw1621107 3 hours ago | parent | next [-]

> Same people who keep the whole rust project going, a lot of those are volunteers aren't they?

Sure, but from my understanding the Rust project is generally "bottom-up" in that volunteers generally work on what they want to rather than submit their time into a pool for some kind of higher-level management to direct.

▲

nicoburns 2 hours ago | parent | prev | next [-]

The core packages (things like rand and regex) are pretty closely audited in practice (albeit it might not catch a credential compromise).

This crate isn't one of them.

	▲	lyu07282 2 hours ago \| parent [-]
		> This crate isn't one of them. still caught in hours though, so just as a general rule: never install anything newer than 7 days old packages cargo feature for this is still unstable infuriatingly: https://github.com/rust-lang/cargo/issues/17009

▲

mirashii 3 hours ago | parent | prev [-]

It’s absolutely mad and extremely entitled to expect that a volunteer group of developers do an order of magnitude or more additional work for no additional pay or benefits to themselves.

	▲	mabini 2 hours ago \| parent [-]
		Not really, if you're putting out something like programming languages and tooling, people expect them to work. Especially because Rust devs brag so much about how it's soo superior to everything else, but then these amateur mishaps happen. Rust isn't getting the exposure it deserves, I think, partly due to arrogance within the Rust community and a mental complex about "being better than everyone else" - that mentality never works