Post

This Rust serde_yml situation is actually insane. Author disabled issues, making random massive AI changes all across the codebase, causing UB, etc. Feels like there needs to be a RUSTSEC warning on this. This is absurd name squatting + awful behavior. See dtolnay’s twitter post if you haven’t…

johnpyp.dev

@johnpyp.dev

I’d go so far as to say this behavior is so erratic as to potentially be hiding something malicious. +4k/-4k line diffs of meaningless stuff mixed with unsoundness. Great way to get xz vulns in there… Crate names like serde_yml come with great power, and this is a crazy example of misusing it.

28/1/25, 8:31 am0 reposts0 likes

No replies yet.