Is Rust the least secure programming language? There was yet *another* massive Rust security failure... and nobody seemed surprised. Most Rust activists simply shrugged at the normalcy of it. Considering the frequency and severity of malicious code being added to the Rust Crates ecosystem... is it the least secure... programming language toolchain?show more

Why the obsession with moving stuff to Rust?

I spent a lot of time coding Rust before moving back to C++. It's all security rhetoric with an ownership model enforced by the compiler that most devs just clone to get around. C++26 is more secure, IMO.

Npm exists so the bar for worst will always be incredibly low

It's more an indictment of the dependency culture in Rust, and an argument for languages with a good batteries-included stdlib (e.g. Nim). Also, a package manager WITHOUT transitive dependencies could work (like header-only libs in C).

Calling Rust "the least secure" because of third-party crate supply chain issues which affect npm, pip, and every modern package manager is peak bad-faith tech panic. Anything to keep the anti-Rust outrage machine funded.

Definitively, I would say not just the least secure but the buggiest one. It is about how its ecosystem was built, and it is still in development. That silly idea of Rust solving memory safety issues and making your systems secure, coming from Rustaceans, is just a fallacy.

No less secure than C.

NodeJS has and will always be less secure than Rust

Not a programmer but when Rust first came out I played around with it and I definitely didn't like it reaching out and getting packages. I think you can cache them but that ecosystem was alarming and now we see why it's a flaw not a feature.

It also just plain doesn’t live up to its safety guarantees. You can write unsafe Rust entirely without using *any* unsafe features.

The government is telling you to use it, so of course it's insecure. They've only given bad advice since 2014.

Rust is just compiled JavaScript but even less readable

because the hard part is never just writing code, it's dealing with the complexity of real-world systems where assumptions can kill you

Why didn't you make a similar video when npm had such supply chain attacks even more frequently than

Ok. Notice the pattern: • PHP —> WP —> plugins —> overpopularity —> target for persistent attack • JS —> Node —> npm —> NextJS — same More? Recast your question. It is not about the language itself, it is about the ecosystem and community filled contents.

Crate is inherently insecure. That's a problem that no one seems to want to address.

People in here are really measuring Rust against node.js? I thought Rust was meant to be a robust systems level language

Simply by crates existing it is.

Every language has its purposes. It's strange to obsess over Rust.

Rust is NOT the programming language. Rust is the Virus...

Hey LarperJournal, any word on anti-woke, based Omarchy coming with a rootshell baked into it? No? Do you need a second to ask AI what that means?

@grok is this true?

So I masked the Rust compiler and Rust binaries, and now I can't install any browsers.

I think rust is a fine language - but it is definetly attracting the worst of FOSS and I can't trust it until it has multiple independent compiler projects.

You could of made this a little more comical..and I say this because at first I thought it was what you were doing. I heard you say at 1:06 "we had another one come in" and I thought it was BREAKING NEWS, like it just happened but then you said "from a couple of days ago".

1. Supply chain attacks in C programs are still possible, and might have even affected lots of software, see XZ Utils and Jia Tan. 2. What about npm package ecosystem, which allows lots of people to publish packages, similarly to crates . io? Also, Shai-Hulud.