@aliide @mttaggart looks like an adequate response by the editor

@0xabad1dea I fail hard on the last item on your list of needed things, so I will not start such a project, I promise

@thisismyglasgow I think it’s wonderful that our American friends love birds so much

@samir True. Apparently that’s the price of having some checks in place.

@samir Goodness, I am behind the times. Some searching tells me that this is the way people handle dependencies now - just pull in some github repo from your makefile. We are not getting better at this security thing, are we.

@samir agree that that would be equally bad, but have not seen people be that silly… that’s probably me though

@samir AI often hallucinates package names. Bad guys squat malware on those names. I don’t think that’s easily done with a C/C++ codebase. With AI-translated Rust code, it could happen. A bigger risk than potential buffer overflows in a mature C program, I think.

@samir I heard that Rust has one of those packaging systems like Python, NodeJS etc where anyone can simply upload a package for others to import, with no checking whatsoever. These are rife with abuse and if Rust indeed has an equivalent system, it is certainly not more secure.

@kthy @clintruin @cstross but what does Grokipedia have to say on the subject? Not going to check, but I strongly suspect not much.

@kthy @cstross and that, infuriating as it is, works