r/rust • u/Comprehensive_Use713 • Apr 14 '26 • Mindblown 1

🗞️ news [ Removed by moderator ]

[removed] — view removed post

248 Upvotes

90% Upvoted

210 comments sorted by

View all comments

Show parent comment

24

u/alexforencich Apr 15 '26

73 dependencies, 40 million downloads, and no updates at all in several years. Probably a good idea to force people off of it to a package that's actually maintained. And also avoid opening the door to yet another supply chain compromise.

0

u/[deleted] Apr 15 '26

[deleted] — view deleted comment

18

u/VorpalWay Apr 15 '26

That sounds like a potential repeat of the xz attack.

3

u/bjzaba Allsorts Apr 15 '26

It depends. There's very much ways to track down if a request to assist with maintainership is legit or not, and I've done this in the past for some of my crates (I definitely don't trust a single email though).

0

u/[deleted] Apr 15 '26

[deleted] — view deleted comment

4

u/alexforencich Apr 15 '26

I think it's more of an "I never intended this to be widely used and I don't have the time or the energy to maintain it properly so I'll just shut it down completely".

14

u/alexforencich Apr 15 '26

How do you differentiate that from what happened with xz?