Google open-sources Rust crate audits
&gt;Before a project starts using a new crate, members usually perform a thorough audit to measure it against their standards for security, correctness, testing, and more.<p>Do they? I mean really? Let&#x27;s lay aside the fact that it&#x27;s almost impossible to eyeball security. I just cannot imagine that Google works so differently to every company I&#x27;ve ever worked at that they <i>actually</i> carefully check the stuff they use. Every company I&#x27;ve worked at has had a process for using external code. Some have been stricter than others, none have meaningfully required engineers to make a judgement on the security of code. All of them boil down to speed-running a pointless process.<p>And that leaves apart the obvious question: I want to use a crate, I check it &#x27;works&#x27; for what I need. Some middle manager type has mandated I have to now add it to crate audit (FYI, this is the point I dropped importing the library and just wrote it myself) so I add it to crate audit. Some other poor sap comes along and uses it because I audited it, but he&#x27;s working on VR goggles and I was working on in-vitro fertilization of cats and he&#x27;s using a whole set of functions that I didn&#x27;t even realise were there. When his VR Goggles fertilize his beta testers eyes with cat sperm due to a buffer overflow, which of us get fired?