

I guess one benefit is rust development often doesn’t use bleeding edge version for everything, where you pull the entirety of crates.io through your machine when you open your IDE. From what I’ve seen most projects use == versions and lock files.
I don’t know enough about rust though. Could an attacker change historical crate versions to a payload and then cargo pulls them because they changed? Or will cargo only pull an update if you change to a different version on your machine?



I’ve noticed a massive overlap between trans and telecom. Even before the internet, telephone phreaks were more often than not trans or trans adjacent, or just straight up eggs before it was cool.