Egregoros

>This package contains just four macros, which enable the creation of array references to portions of arrays or slices (or things that can be sliced).

Do Rustfags really

@scathach they are just JS monkeys of the systems software world. The more experience I get, the more I agree with the idea of just vendoring dependencies and building everything locally. You want a new library version? Show which piece of code you want or fuck off.

@newt @scathach Code reuse as pushed by npm/crates was the hot topic back in the Internet boom, but the results over the years have clearly shown that the problems far outweigh the benefits. From left-pad to protestware nuking your system only because you have your locale set to something the dev doesn't like (Yes, this has actually happened multiple times already in the JS world.)

@newt @scathach Similarly, a lot of these "supply chain attacks" would never exist if every single one of these deranged language package managers didn't have post-install script hooks. A literal RCE the developer has on your system just by installing a package.

@phnt @scathach I blame and Loinoos for this. "Given enough eyeballs, all bugs are shallow" my ass. Good luck reviewing every piece of shitware that might run on your system.

@newt @phnt @scathach its funny. some time ago i read that packagers for linux distros don't really read the code (at least for opensuse, because it was an opensuse drv) of the things they package.
and.. there was a bug in polkit that gave you root access that no one noticed for 8 years. shallow my ass

@mischievoustomato @newt @scathach Same with the 30 recent Linux kernel LPEs that have been in the kernel for a decade. Or with the uni "project" that inserted multiple bogus commits and small vulnerabilities into the kernel and it took like a year for someone to notice.