It just looks like stdx has copied stuff from crates and put it in a git repo.
It feels like this is worse than a package manager? As in why would I trust a random git repo to keep things up to date over the officially published channel?
It feels like this is worse than a package manager? As in why would I trust a random git repo to keep things up to date over the officially published channel?
base64 = { git = "https://github.com/rust-stdx/stdx", rev = "<sha1 of malicious commit in fork>" }The other reason I don’t trust them is because this repo is 100% AI slop, even for crypto code. He posted it on /r/rust where every comment was highly negative - https://www.reddit.com/r/rust/s/4I4Xc7x7ec. The thread was removed by a moderator with the note:
Please, stop posting articles from kerkour.com.
The blog has been on a downward spiral for years, it's doomed, let it go.
Argumentum ad hominem, yuk
> the fundamental mistake of assuming that they’re trustworthy and we’d trust them no questions asked.
The author makes no such assumption, it is entirely your decision
> this repo is 100% AI slop,
That is an exaggeration. It is coded with AI help, as is almost everything these days
Agree, or disagree, that an anemic standard library is a problem, and crates.io is a glaring security risk and a looming catastrophe Kerkour is doing something about it
This is a start
The revision must be an ancestor of one of the module repository’s branches or tags. This prevents attackers from referring to unapproved changes or pull requests.
(I’m more worried about judgement calls than implementation correctness, it’s not about AI.)
> crypto: spec and test-driven development to the rescue
> Cryptographic code is famously hard, with many, many footguns haunting unsuspecting developers (and even experts!).
> But, cryptography also has something that you likely won't find in any other domain: an extensive public collection of test vectors, particularly for edge cases. Every algorithm specification come with a basic suite of test vectors, but there are also community-built wonders such as Wycheproof.
> These test vectors, combined with the official specification documents of the crypto algorithms were rather effective to guide the coding agents and avoid the worst hallucinations.
> Cost: ~ $30
> Time: multiple days of part-time work.
> I'm under no illusion that the crypto crate is currently bug-free, but if my experience told me anything, it's that even experienced programmers are shipping bugs in crypto libraries. So, for similar outcomes, but using 1/100 of the time and at maybe 1/1000 of the cost, I think it's a clear demonstratin of AI's effectiveness.
Yeah, terrifyingly clueless, don't use.
Hence “strong sign this is built by people who have no idea what they’re doing” is accurate.
So as I understand it, they're not suggesting that we pile many packages into 1 git repo as a sort of pseudo-crates.io, they're just promoting the fact that you can install a package directly from a git URL, rather than using a crate name on a registry.
What seems weird about that model to me is that dependancies will not sync between these individual packages. If package A chooses the canonical git URL for package C, and package B uses a self-hosted version of package C instead, you have two versions of package C.
The big question about this project isn't its distribution, it's the core question it posed when it was first announced: are Rust developers going to seriously entertain an alternative "standard library" curated by one developer.
> are Rust developers going to seriously entertain an alternative "standard library" curated by one developer.
No. Absolutely not
But this is a start. Join the effort. Help them
It is one repo to trust, rather than hundreds
That is the reason
And the chances of a rogue actor or id theft reduce drastically.