Fixing Rust's supply chain security: The good, the bad and the ugly

I feel like a broken record so appologies if I say the same thing every time.

I don't want a fat std lib. What should or shouldn't go into the std lib? Something like axum might be reasonable for some but not me if I want to target something smaller. Creating a fat std lib also increases the load on a team that's already stressed.

Go can do things like include a web server because that's what the language is for, making web servers.

Personally I'd prefer if the foundation nominate a few projects such as Tokio and take them under their wing. The maintainers would stay the same but the foundation would provide funding and a stricter governing and auditing in the same way as the main language does.

I think sandboxes are just kicking the can down the road. Companies are running scans on crates io, I'd like to see a first party one from the foundation as well, required before a package could fully be published.

Cooldowns are another option but honestly I'd rather them be able to be scanned in some sort of resitrcted format

perhaps cargo add tokio --force-latest

so scanners could grab them but not people