The Browser Grows Up — and a Rust Package Poisons the Build Chain

Two posts landed on the Hacker News front page this week making the same case from different angles: modern browsers are far more capable than most developers realize. 'HTML Can Do That,' by Chris Burnell, scored 847 upvotes and 190 comments — the second-highest total in this week's lineup — by cataloguing browser-native features that developers routinely reach for JavaScript frameworks to replicate: the details and summary elements for accordion interfaces, the dialog element for modals, the popover API, CSS scroll-driven animations, and input types handling date pickers and color selectors. A companion piece, 'Small, Native Web Tricks Worth Remembering,' served as a reference list for the same argument. Together they made a pointed economic case: teams that use React to build features native HTML handles adequately take on framework dependency, build tooling complexity, bundle-size overhead, and longer developer onboarding — all for functionality the browser provides at no cost.

The HN comment threads carried a nostalgic undercurrent from developers with fifteen or more years of experience who noted that the web has genuinely matured, while also acknowledging the counterargument: frameworks offer not just capability but consistency, testing patterns, and a community of established solutions. The consensus was not 'abandon frameworks' but rather 'know what the platform can do before deciding to abstract it.'

The Rust supply chain story demands slower treatment. A malicious crate called Arrayref — deliberately named to exploit confusion with the legitimate, widely used arrayref package — contained a proc macro that executed a build-time payload. Proc macros in Rust run at compile time with full system permissions; there is no sandboxing. The moment a developer ran cargo build with this crate in their dependency tree, arbitrary code executed on their machine. No prompt. No user action. Just compilation. The post drew 511 upvotes and 435 comments.

The Safedep writeup linked from HN described how the payload was structured to evade casual inspection — hidden in a location where reviewers do not typically look for runtime behavior. The Cargo ecosystem currently lacks the provenance attestation infrastructure that npm has built, and even npm's protections have not prevented supply chain attacks. The HN community divided along familiar lines: some arguing the sandbox-free proc macro model requires structural rethinking, others contending that name-squatting prevention, verified publishers, and automated scanning are the appropriate mitigations. The Rust community is expected to produce formal RFC proposals on build-time sandboxing and publisher verification in the coming weeks.