[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Proposal for how to deal with Go/Rust/etc security bugs (was: Re: Limited security support for Go/Rust? Re ssh3)



On Jan 24, Peter Pentchev <roam@ringlet.net> wrote:

> This might be a minority, optimistic, rose-tinted-glasses kind of
> opinion, but I believe that the state of the Rust ecosystem today
> (I have no experience with the Go one) is quite similar to what Perl and
> Python modules were 25, 20, bah, even 15 years ago. Gradually, with time,
I am not familiar with the Python ecosystem, but I have been writing 
Perl and packaging software with Perl dependencies for over 25 years and 
I can confidently say that this is not true.
Perl libraries ("modules") generally never had the API instability that 
I have seen in Rust libraries (but much less in Go, I believe).
In my experience forward compatibility has always been very important in 
the Perl ecosystem.

BTW, for the past couple of years I have been presenting to my other 
community, the network operators, about some of my Debian work and these 
problems with integrating complex Rust software in distributions, e.g.
https://www.linux.it/~md/text/rpki-validators-euroix2023.pdf .

-- 
ciao,
Marco

Attachment: signature.asc
Description: PGP signature


Reply to: