Lessons from TARmageddon: What Rust Can Learn

kept by northernlightz oct 06

A logic bug in four Rust tar crate forks showed that memory safety alone doesn't prevent security flaws, highlighting fork sprawl and the need for sans-io design.

Announcing the Beta release of ty
Astral released the beta of ty, a Rust-based Python type checker and language server that is significantly faster than mypy and Pyright.
also on uv, #rust, #developer-tools
Package Managers Need to Cool Down
A survey finds that while many package managers and update tools have adopted dependency cooldowns to prevent supply chain attacks, implementations vary wildly in naming, scope, and timestamp handling, and major ecosystems like Go, Maven, and Gradle still lack support.
also on uv, #security, #open-source, #developer-tools