alt Hacker NewsOne thing would be shipping interfaces without implementations. Rust could try to ship more traits without implementations, I do see it could be problematic with Rust as they don't try to be opinionated on what you will build.
There is another alternative too, releasing interface only packages, then hoping everyone agrees to use those. JavaScript/TypeScript people actually did this already for one very tricky one, validation, see Standard Schema [1], which was great success. But I would hope to see more, for instance interfaces around typical building blocks like job queues, email sending etc.
Thanks, quite an achievement they got people to agree on the interface. However, for supply chain attacks the danger lurks in the implementation, not in the interface. You could argue that this approach comes with the benefit that one could switch implementation when one library goes rogue, but that is imho too little and too late.