Hacker News Reader

If I remember correctly, rust compiles to static binaries by default, meaning they include a copy of all used parts of both libraries and standard library in the executable.

Does that mean that any Rust program compiled with any affected version of the standard library is affected? How would I even find those?

Statically linked binary make deployments really easy, but this one scenario where they have real downsides.

View on HN

> Does that mean that any Rust program compiled with any affected version of the standard library is affected?

Most programs don't use `remove_dir_all`, and a smaller fraction of those use it on a directory that untrusted actors can write to.

But yes, tracking down those that do is a challenge.

The bug exists in all versions of libstd before today's, so in this case finding possibly affected Rust programs is easy: all of them.

As for other situations: when Rust programs are built with Cargo, it creates a Cargo.lock file, which is a machine-readable record of all dependencies and their checksums used in the build. Distros could archive it and later use it track all affected dependencies. Unfortunately, libstd is a magical compiler built-in, not a regular dependency, so it doesn't get recorded that way.

How do I find out if an executable was built with rust? (Assuming it's not my code...)

Reply on news.ycombinator.com