Post

This Rust serde_yml situation is actually insane. Author disabled issues, making random massive AI changes all across the codebase, causing UB, etc. Feels like there needs to be a RUSTSEC warning on this. This is absurd name squatting + awful behavior. See dtolnay’s twitter post if you haven’t…

28/1/25, 8:29 am0 reposts0 likes

johnpyp.dev

@johnpyp.dev

28 Jan 2025

I’d go so far as to say this behavior is so erratic as to potentially be hiding something malicious. +4k/-4k line diffs of meaningless stuff mixed with unsoundness. Great way to get xz vulns in there… Crate names like serde_yml come with great power, and this is a crazy example of misusing it.