Serde project faces resistance from Rust devs over precompiled binaries
Originally Published 2 years ago — by BleepingComputer
The popular Rust (de)serialization project, Serde, has faced pushback from developers after deciding to ship its serde_derive macro as a precompiled binary. Concerns have been raised about the legal and technical implications, as well as the potential for supply chain attacks if the maintainer's account is compromised. Some developers have requested that precompiled binaries be kept optional and separate from the original crate, while others have likened the move to a controversial code change in the Moq .NET project. The decision has sparked a debate about the security risks and the need for an opt-out option.