undefined | Better HN

0 pointsmeragrin_2y ago0 comments

So what in there guarantees I can get the same thing they audited?

0 comments

3 comments · 1 top-level

GrumpySloth2y ago· 2 in thread

Version numbers. You can’t modify an already-published version of a Rust crate on crates.io.

Who in practice pins their dependencies (transitive included) on audited versions?

Small companies with little development experience like Google and Mozilla.

(You can check the files I linked and see audits between deltas for minor version updates)

j / k navigate · click thread line to collapse