Concerns Regarding the Choice of Rust for the Xfce Wayland Compositor

[Michael Wyraz]

Hello,

>> The second concern is the supply chain risk from Cargo and crates.io. 
>> Using Rust means pulling in a large number of external dependencies, 
>> which introduces a significant attack surface that does not exist in 
>> a pure C project.
>>
>
> This is absolutely true, and is the one and only thing that worries me 
> about using Rust.  I'm not sure what the solution is here, if there is 
> one.  Both smithay and gtk-rs pull in quite a lot of transitive 
> dependencies, and there's not much that can be done about that.  I 
> think software ecosystems as a whole are only just starting to figure 
> out what to do about supply chain issues around centralized dependency 
> managers, and there's still a lot of work to be done to increase 
> security and confidence.

I'm sure there is a way to pin versions (like a package.lock 
equivalent). Why not use AI to do a full review of all dependencies on 
every change and make this mandatory? I know, many OSS projects 
discourage the usage of AI for development (e.g. for licensing reasons). 
But using it for code review should be legally safe and brings the 
ability to do extensive reviews with limited capacities.

Kind regards,

Michael.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.xfce.org/pipermail/xfce4-dev/attachments/20260617/8ae4d140/attachment.htm>