Vetting the cargo

And that audit will cover only the versions that were audited, so if you trust that organization to do good audits, you'll be safer than you otherwise would be. If you make the mistake of trusting that because that organization has audited an *old* version the *new* version must be safe, that's your mistake, not that organization's mistake.

This is an improvement over the current state, where it's much easier to do malicious things and not get caught.

> I would argue that it's definitevely worse, as I now have a tool that tells me it's definitely ok to do that.

No, you have a tool that's making it possible to be selective about who you trust and tracking exactly what versions you trust, as opposed to implicitly trusting everyone. If you then choose to trust the wrong people, a tool can't help you with that.

> I would also add that there is no actual reason to not trust the author of all-padding. On what ground should I do that?

There's no reason *to* trust the author of all-padding to vet other software. You are repeatedly introducing the assumption that because a previous version appears safe the developer of that version should be trusted to audit other things, and then saying that if you do that, someone who earns trust with their previous code can break that trust. cargo-vet is designed to *not* make that assumption.

Potentially good criteria for delegating your audits to someone else would include "they're a part of the same company as you and this is their job", or "they're part of a trusted industry organization". Bad criteria for delegating your audits include "they wrote an apparently decent library once".

> But given the choosen development model (as the developpers of cargo-vet calls it: "low-friction reuse of third-party components") this is just bandage on a wooden leg. The problem is that the development model in itself is dangerous.

There are other solutions in the works as well, such as WebAssembly components that allow using a dependency without giving full trust to that dependency.

But in the meantime, this is an improvement over the status quo. And using third-party dependencies rather than reimplementing them is a net improvement.