Learning Rust and Lemmy

391 readers

1 users here now

Welcome

A collaborative space for people to work together on learning Rust, learning about the Lemmy code base, discussing whatever confusions or difficulties we're having in these endeavours, and solving problems, including, hopefully, some contributions back to the Lemmy code base.

Rules TL;DR: Be nice, constructive, and focus on learning and working together on understanding Rust and Lemmy.

Running Projects

Rust for Lemmings Reading Club (portal)
Rust beginners challenges (portal)
Heroically Helpful Comments

Policies and Purposes

This is a place to learn and work together.
Questions and curiosity is welcome and encouraged.
This isn't a technical support community. Those with technical knowledge and experienced aren't obliged to help, though such is very welcome. This is closer to a library of study groups than stackoverflow. Though, forming a repository of useful information would be a good side effect.
This isn't an issue tracker for Lemmy (or Rust) or a place for suggestions. Instead, it's where the nature of an issue, what possible solutions might exist and how they could be or were implemented can be discussed, or, where the means by which a particular suggestion could be implemented is discussed.

Rules

Lemmy.ml rule 2 applies strongly: "Be respectful, even when disagreeing. Everyone should feel welcome" (see Dessalines's post). This is a constructive space.
Don't demean, intimidate or do anything that isn't constructive and encouraging to anyone trying to learn or understand. People should feel free to ask questions, be curious, and fill their gaps knowledge and understanding.
Posts and comments should be (more or less) within scope (on which see Policies and Purposes above).
See the Lemmy Code of Conduct
Where applicable, rules should be interpreted in light of the Policies and Purposes.

Relevant links and Related Communities

Thumbnail and banner generated by ChatGPT.

founded 9 months ago

MODERATORS

[email protected]

Looking to learn Rust? Curious about Rust? Feel free to ask me (feddit.dk)

submitted 7 months ago by [email protected] to c/[email protected]

45 comments fedilink hide all child comments

Hey!

I'm a professional software engineer with several years of experience using Rust. Unfortunately I don't really have the time to contribute to Lemmy directly myself, but I love teaching other people Rust so if:

You are curious about Rust and why you should even learn it
You are trying to learn Rust but maybe having a hard time
You are wondering where to start
You ran into some specific issue

... or anything to do with Rust really, then feel free to ask in the comments or shoot me a PM 🙂

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 7 months ago (2 children)

I've been wanting to write rust for quite some time, but I can't get over crates. The system just seems insecure to me. What happens in 10 years when the servers go down? Is there any sort of mitigation for supply chain attacks? As I understand it anyone can submit code; what's stopping someone from putting malicious code into a crate I've been using?

I suppose these are risks for any third party package system though.

I've used Flutter infrequently and have experienced things like this with their package system.

[–] [email protected] 3 points 7 months ago (1 children)

I’ve been wanting to write rust for quite some time, but I can’t get over crates. The system just seems insecure to me.

You're not the only one with this concern but it is essentially how modern package management works, not just for Rust but all modern programming languages.

What happens in 10 years when the servers go down?

While I don't think that would happen, there are ways to avoid this. You can host your own registry and mirror the crates.io crates, if you want.

Is there any sort of mitigation for supply chain attacks?

Whenever you have dependencies, you obviously need to either trust them or vet them. If the package is popular enough and the author is reliable enough, then you can choose to trust it. It really depends on what kind of risk you're willing to take on.

As I understand it anyone can submit code; what’s stopping someone from putting malicious code into a crate I’ve been using?

In principal nothing. Again, if you have dependencies, you need to vet them. This isn't really a Rust problem, it's just a general problem with depending on other people's code. You would still have this problem even if you manually downloaded external pieces of code from other people instead of via cargo.

In practice, there is a team managing crates.io and I believe they do look for malware or malicious crates (like crates with names very similar to popular crates that attempt to trick people into downloading due to a typo in the name).

But yes, this isn't really a problem with Rust specifically. I will say that the popular crates in the Rust ecosystem are generally very high quality and I have a fair bit of trust for them myself. Unless you are a big company that needs to carefully vet your dependencies, I wouldn't worry too much.

[–] [email protected] 3 points 7 months ago

Thanks for your detailed input, I'm glad to hear that there is a team that does look out for things at crates.io, and that I can host my own registry.