crev-dev/cargo-crev on Hacker News

…and last I checked didn't have as many/as consistent reviews. https://github.com/mozilla/cargo-vet https://github.com/crev-dev/cargo-crev

comment by elabajaba · 2025-05-10 · in Rust’s dependencies are starting to worry me

…languages, but I’m not sure about the maturity of those integrations and their ecosystems. [0] https://github.com/crev-dev/cargo-crev [1] https://mozilla.github.io/cargo-vet/ [2] https://github.com/crev-dev/crev/

comment by karlding · 2025-03-27 · in Malware found on NPM infecting local package with reverse shell

…really any solution besides "have people publicly document the source code they have read", like https://github.com/crev-dev/cargo-crev does. Often people ask "how do I know whose reviews to trust", but in reality there's a scarcity of…

comment by kpcyrd · 2025-02-09 · in A tale of distros joining forces for a common goal: reproducible builds [video]

…source code/build instructions. For that we'd need some sort of source code reviewing effort like https://github.com/crev-dev/cargo-crev implements. I've started whatsrc.org to keep track of the source code inputs we're putting into our…

comment by kpcyrd · 2025-02-08 · in A tale of distros joining forces for a common goal: reproducible builds [video]

…a lot of work in that area but it never really took off, people don't want to think about trust: https://github.com/crev-dev/cargo-crev

comment by remram · 2025-01-22 · in Sigstore: Making sure your software is what it claims to be

…of volunteers. even the super fancy Rust community kind of shrugged and let crev die silently https://github.com/crev-dev/cargo-crev

comment by pas · 2024-04-01 · in Xz/liblzma: Bash-stage Obfuscation Explained

…something strange in CI and you can catch it. the only real solution is a reputation system (like https://github.com/crev-dev/cargo-crev ), which of course is unfortunately barely used

comment by pas · 2024-02-29 · in Over 100k Infected Repos Found on GitHub

…so far is Crev https://github.com/crev-dev/crev/ . It's most used implementation is Cargo-crev https://github.com/crev-dev/cargo-crev , but hopefully it will become more required to use these types of tools. Certainty and metrics about how…

comment by chaxor · 2024-01-06 · in Hard disk LEDs and noisy machines

…repository like Debian is doing (which hopefully gets enough eyeballs to remain secure) or the https://github.com/crev-dev/cargo-crev project (manually reviewed code) also mentioned. It's interesting that they mention C/C++ just rely on…

comment by brabel · 2023-11-14 · in Rust without crates.io

…about it immediately. The solution seems to be much more clearly in the realm of things like crev: https://github.com/crev-dev/cargo-crev/ Wherein users can get a clear picture of what dependencies are used in the full chain, and how they…

comment by chaxor · 2023-06-07 · in Tell HN: "I don't care about cookies” extension bought by Avast, users jump ship

There is a similar idea being explored with https://github.com/crev-dev/cargo-crev - you trust a reviewer who reviews crates for trustworthiness, as well as other reviewers.

comment by JadedBlueEyes · 2023-01-26 · in Pip and cargo are not the same

…integrity hashes That sounds like some combination of Crev[0], Sigstore[1], and Trillian[2]. [0] https://github.com/crev-dev/cargo-crev/blob/master/cargo-cre... [1] https://docs.sigstore.dev/ [2] https://transparency.dev/

comment by dane-pgp · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30

…s://github.com/rustsec/rustsec/tree/main/cargo-audit https://github.com/rust-secure-code/cargo-geiger https://github.com/crev-dev/cargo-crev

comment by throwup · 2022-12-01 · in Memory Safe Languages in Android 13

…Also there's a Perl6 story somewhere here. (Relevant xckd[1], relevant c2 entry[2] ) [0] https://github.com/crev-dev/cargo-crev [1] https://xkcd.com/224/ [2] https://wiki.c2.com/?SecondSystemEffect

comment by pas · 2022-11-14 · in Deno 1.28: Featuring 1.3M New Modules

'cargo crev' makes this kind of workflow possible: https://github.com/crev-dev/cargo-crev

comment by burntsushi · 2022-10-18 · in “You meant to install ripgrep”

…that's Debian / Ubuntu / Red Hat, or maybe it's through a review system like Rust's cargo-crev: https://github.com/crev-dev/cargo-crev Minimizing the number of dependencies helps a lot too. But don't blindly npm or pip install something…

comment by collinmanderson · 2022-08-12 · in No, you cannot trust third party code without reading it first

…Rust, so I'll do it. cargo-crev is a nice web-of-trust type code review system for Rust crates. https://github.com/crev-dev/cargo-crev

comment by howdydoo · 2022-01-10 · in What NPM should do to stop a new colors attack

…audits the actual diffs? "npm-crev" can't come soon enough... https://web.crev.dev/rust-reviews/ https://github.com/crev-dev/cargo-crev

comment by pas · 2022-01-10 · in Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

…functional/business requirements. something like cargo-crev for npm might be a long term solution https://github.com/crev-dev/cargo-crev

comment by pas · 2021-12-12 · in We check our node_modules folder into source control

…but it greatly mitigates other classes of attack. [0] https://github.com/kpcyrd/pacman-bintrans [1] https://github.com/crev-dev/cargo-crev

comment by dane-pgp · 2021-11-20 · in I Love Arch, but GNU Guix Is My New Distro

Cargo-crev's writ seems to be much more expansive and nebulous than security: https://github.com/crev-dev/cargo-crev/wiki/Howto:-Create-Re... > While it's still open for debate, the current opinion is that additional fields are not useful…

comment by rectang · 2021-11-18 · in Backdooring Rust crates for fun and profit

…point you checked out initially. About bootstrapping, several strategies are possible: - [crev]( https://github.com/crev-dev/cargo-crev ) is an alternative (not PGP/SSH based) web of trust for vetting code - [radicle]( https://radicle.xyz/…

comment by southerntofu · 2021-11-13 · in Sign arbitrary data with your SSH keys

…git repository, for reasons outlined by the blog post. This is how cargo-crev already works: https://github.com/crev-dev/cargo-crev

comment by kpcyrd · 2021-10-17 · in Rust: Does the published crate match the upstream source?

The reviewing aspect sounds a lot like cargo-crev. [1] [1] https://github.com/crev-dev/cargo-crev

comment by the_duke · 2021-08-09 · in Sigstore – A new standard for signing, verifying and protecting software

…Also related: cargo-crev [1] explores a concept for shared auditing and trust for Rust crates. [1] https://github.com/crev-dev/cargo-crev

comment by the_duke · 2021-03-29 · in Netmask NPM package, used by 270k+ projects, vulnerable to octal input data

…an implementation. Here's the previous HN discussion [2]. [0] https://github.com/crev-dev/crev/ [1] https://github.com/crev-dev/cargo-crev [2] https://news.ycombinator.com/item?id=18824923

comment by karlding · 2020-11-03 · in Malicious NPM package opens backdoors on programmers' computers

Maybe using crev? https://github.com/crev-dev/crev https://github.com/crev-dev/cargo-crev Probably just publish it and eventually you will get some review or bug reports.

comment by pabs3 · 2020-10-21 · in Ask HN: How to find code reviewers for new FOSS projects?

…you could extend this to AUR packages with a bit of work. [0] https://github.com/crev-dev/crev/ [1] https://github.com/crev-dev/cargo-crev

comment by karlding · 2020-04-22 · in Running an independent Arch Linux rebuilder

…also cargo-crev, which is an attempt at making a web of trust for reviews of third party packages: https://github.com/crev-dev/cargo-crev - for a longer form article on what crev's goals are and how it works, I found this explained it for…

comment by Macha · 2020-01-17 · in A Sad Day for Rust

…vs nodeJS issues) etc. PS: there are projects that aim to do collaborative audit/review for Rust ( https://github.com/crev-dev/cargo-crev ) there should be something like that for the JS world. also there's the NPM "report vulnerability"…

comment by pas · 2020-01-06 · in Always Review Your Dependencies, AGPL Edition

…that is supposed to do X, can't do Y. Until then, we need to vet our dependencies. Check out https://github.com/crev-dev/cargo-crev/tree/master/cargo-cre... for a distributed review system we're working on.

comment by dpc_pw · 2019-12-05 · in Two malicious Python libraries caught stealing SSH and GPG keys

But also has a solution: https://github.com/crev-dev/cargo-crev

comment by dpc_pw · 2019-08-28 · in Rust is the future, C is the new Assembly: Josh Triplett (Intel)

…at least one tool for this that I've started using, although I don't think it's very widely used: https://github.com/dpc/crev/tree/master/cargo-crev Ironically this depends on a whole slew of additional packages I haven't yet reviewed to…

comment by MaulingMonkey · 2019-07-29 · in Malicious code in the purescript NPM installer

Relevant I'm working on a system for auditing open source libraries: https://github.com/dpc/crev . Currently focused on Rust/crates.io.

comment by dpc_pw · 2019-04-04 · in Malicious remote code execution backdoor discovered bootstrap-sass Ruby gem