Crate security in 2025
summary
Notes concrete claims and tools: Zed shows 122 direct and 882 unique crate dependencies, bat shows 30 direct and 119 transitive, typical projects have ~200–300 dependencies. Lists real incidents (XZ backdoor, malicious Rand-like crate, 2023 exfiltration attempts). Describes operational tooling and proposals: use cargo tree, cargo vet / cargo crev, cargo audit / cargo deny, d.rs, li.rs, deps.dev, SBOMs; mentions trusted publishing RFC and adoption of the Update Framework (TUF) and ongoing crate scanning by Rust Foundation and OSSF. Presents actionable checks and tradeoffs.
AI-written summary · about
chapters (14)
- 0:00Crate security intro
- 1:05Supply chain basics
- 2:08Why dependencies matter
- 8:05Balancing needs and risks
- 12:38Supply chain attacks
- 16:30Rust Foundation efforts
- 20:21Securing your project
- 22:44Evaluating crate quality
- 30:07Using security advisories
- 31:52Assessing dependency practices
- 35:45Sustainable crate maintenance
- 37:48Selecting the right crate
- 40:38Community role in security
- 42:00Q&A
related talks
45mBuilding Safe and Secure Systems in Rust
29mPublishing High-Quality Crates
18mAuditing Rust Crates Effectively
25mUnlocking the full potential of Cargo extensions in Rust development
35mWhat it'll take to eradicate unintended breakage from Rust
19mCounterexamples in Safe Rust
32mBuilding and Maintaining Rust at Scale
22mShipping a Solid Rust Crate