Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Was Rust Worth It?

jsoverson.medium.com

Post reply on HN
Print view View original

291–300 of 736 posts

Re: Was Rust Worth It?

#291

Post by lolinder »

cmrdporcupine wrote: post #280
devman0 wrote: post #261

Earlier quoted context omitted.

The left pad issue was kind of wild coming from the enterprise Java space. Supply chain attacks against open source software were already being taken pretty seriously, my last company had it's own Maven repository manager running that was used to stage and vet packages before they could be used in production.

Yeah it's all a bit of revisionist history here, or I guess a bit ignorant. I had a friend who worked at Sonatype from pretty early days and they were, as I understand it, specifically working in this area of infrastructure for vetting, signing, license checking, etc. for corporate environments that needed to be extra careful about this stuff. That crates.io launched without explicitly acknowledging this whole proble…

It's not revisionist history, the wording I chose was meant to acknowledge that there were segments of the industry that did take dependencies seriously. I'm very much aware that the Java world had a much more robust approach to dependencies before this, but "the industry as a whole" includes all the Node shops that were hit by leftpad as well as all the Python and Ruby shops that were using equally lousy dependency management techniques.

Rust chose to follow the majority of languages at the time. Again, as I noted in my previous comment, I'm not defending that decision, just pointing out that most of the widely-used languages in 2014 had a similar setup with similar weaknesses.

Re: Was Rust Worth It?

#292

Post by JohnFen »

HKH2 wrote: post #174
JohnFen wrote: post #95

I'm learning Rust because it seems clear that it's going to be important professionally. I wish I loved it, I really do. I see the benefits. But, at least so far, it's one of the most unpleasant languages I've used. I keep hoping that as I gain proficiency, I'll stop disliking it, but as I climb higher on the learning curve, I'm not really warming to it. It's fine. It won't be the only language I'll be proficient in…

Well, what do you dislike about it?

Good question! There's no single thing, I think, and the things I dislike about it aren't even really technical criticism or the like. They're more... aesthetic? I find the syntax unpleasant, for instance. It's extremely opinionated and a few of those opinions are ones I disagree with.

Also, just generally, it tends to make even simple things pretty complex. I understand why and am not really objecting to that, but it does make using it a bit like running with lead shoes.

I expect that the latter part may get better as I use it more (but perhaps not -- there are other languages I'm fully competent in but dislike for similar reasons).

Re: Was Rust Worth It?

#293

Post by JohnFen »

two_handfuls wrote: post #207
JohnFen wrote: post #95

I'm learning Rust because it seems clear that it's going to be important professionally. I wish I loved it, I really do. I see the benefits. But, at least so far, it's one of the most unpleasant languages I've used. I keep hoping that as I gain proficiency, I'll stop disliking it, but as I climb higher on the learning curve, I'm not really warming to it. It's fine. It won't be the only language I'll be proficient in…

Find a tutor or mentor. It can make a huge difference.

In what way? I'm not really struggling much with the mechanics or logic of it...

Re: Was Rust Worth It?

#294

Post by cmrdporcupine »

lesuorac wrote: post #29
yarg wrote: post #20

Earlier quoted context omitted.

This needs to be resolved by every damned language. Just make signed dependencies a universal default, point to an https page for the package vendor and use the signing key from there. Neither node nor maven ever bothered to solve this, so we end up wandering the Wild West wondering when it will be that HR, or legal, or architecture comes knocking on the door to ask what we were thinking having a dependency on a dyna…

I don't think that's the real solution. Pay somebody either internally or externally to maintain a repo of all your dependencies and point your code at that. You won't get a left-pad incident. You won't get a malicious .so incident (unless you mirror binaries instead of source code). Like if you ran out of screws to make your product with do you walk around the street and scrounge up some? No, you go to a trusted ven…

There's reasons why Google projects don't go out on the internet to get their 3rd party deps.

They're all checked into Google3 (or chromium, etc.). One version only. With internal maintainers responsible for bringing it in and multiple people vetting it, and clear ownership over its management. E.g. you don't just get to willy nilly depend on a new version -- if you want to upgrade what's there, you gotta put a ring on it. If you upgrade it, you're likely going to be upgrading it for everyone, and the build system will run through the dependent tests for them all, etc.

And the consequence is more responsible use of third party deps and less sprawling dependency trees and less complexity.

And additional less security concerns as the code is checked in, its license vetted, and build systems are hunting around on the Internet for artifacts.

Re: Was Rust Worth It?

#295

Post by xhainingx »

adastra22 wrote: post #40
tantalor wrote: post #19

> I started writing tests in Rust as I would in any other language but found that I was writing tests couldn’t fail. This is a common refrain in C++ testing: if it compiles then it's probably correct. > Rust has accounted for so many errors that many common test cases become irrelevant In practice, if you think this way I think it's a sign that you aren't testing the right things in those other languages. You should…

> This is a common refrain in C++ testing: if it compiles then it's probably correct. I’ve heard this in Haskell and in Rust. I’ve never heard it applied to C++…

It's truer in C++ than java or similar languages ime since java relies more on exceptions, but it's certainly not as true as Haskell or rust

Re: Was Rust Worth It?

#296

Post by anon-3988 »

kuon wrote: post #231

I wrote a lot of rust, but after some years it still feels unproductive. I do a lot of zig now and I am like 10 times more productive with it. I can just concentrate on what I want to code and I never have to wonder what tool or what library to use. I know rust gives memory safety and how important that is, but the ergonomic is really bad. Every time I write some rust I feel limited. I always have to search libraries…

I am curious what kind of code you are writing? Is it very low level or very high?

>I know rust gives memory safety and how important that is, but the ergonomic is really bad. Every time I write some rust I feel limited. I always have to search libraries and how to do things. I cannot just "type the code".

You don't have to search libraries and figure out how to do things in Zig?

Re: Was Rust Worth It?

#297

Post by mamp »

two_handfuls wrote: post #207
JohnFen wrote: post #95

I'm learning Rust because it seems clear that it's going to be important professionally. I wish I loved it, I really do. I see the benefits. But, at least so far, it's one of the most unpleasant languages I've used. I keep hoping that as I gain proficiency, I'll stop disliking it, but as I climb higher on the learning curve, I'm not really warming to it. It's fine. It won't be the only language I'll be proficient in…

Find a tutor or mentor. It can make a huge difference.

ChatGPT has helped me survive learning Rust.

Re: Was Rust Worth It?

#298

Post by skavi »

osigurdson wrote: post #235

>> I started writing tests in Rust as I would in any other language but found that I was writing tests that couldn’t fail. I'm curious if this is other's experience as well. I've only dabbled in Rust but it isn't clear to me how it would ensure that the code is correct.

It does nothing special compared to the rest of the field of strongly typed MLish languages.

Re: Was Rust Worth It?

#300

Post by MrRolleyes »

riku_iki wrote: post #227
jowea wrote: post #178

Earlier quoted context omitted.

> * Everything is a Box >. This is closest to dynamic garbage-collected languages, but with vastly improved performance. Wait, reference counting everything all the time is faster than normal garbage collection?

I think more importantly it is reference counting across threads, meaning mutexes and breaking memory barrier with large performance penalty.

I believe you're discussing 'Arc'. 'Rc' is not thread safe.
Post reply on HN