Open Source

31359 readers

96 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago

MODERATORS

[email protected]

130

Radicle: Open-Source, Peer-to-Peer, GitHub Alternative (andrew.masto.host)

submitted 9 months ago by [email protected] to c/[email protected]

55 comments fedilink hide all child comments

Radicle: Open-Source, Peer-to-Peer, GitHub Alternative
https://radicle.xyz/
@opensource

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 8 months ago* (last edited 8 months ago)

You're talking about using the language and preventing errors. That's less about security and more about preventing errors.

I'm talking about the supply chain, watering hole attacks, etc. Crates does not cryptographically verify the authenticity or anything that it downloads.

The only language that I'm aware of that has a dependency manager that has cryptographic auth of everything it downloads is Java's Maven. Everything else is vulnerable, rust included.