Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Was Rust Worth It?

jsoverson.medium.com

Post reply on HN
Print view View original

371–380 of 736 posts

Re: Was Rust Worth It?

#371

Post by jiggawatts »

rat87 wrote: post #358
jiggawatts wrote: post #187

Earlier quoted context omitted.

Just some random Cargo security-related issues I noticed: - No strong link between the repo and the published code. - Many crates were spammed that were just a wrapper around a popular C/C++ library. There's no indication of this, so... "surprise!"... your compiled app is now more unsafe C/C++ code than Rust. - Extensive name squatting, to the point that virtual no library uses the obvious name, because someone else…

> Extensive name squatting, to the point that virtual no library uses the obvious name, because someone else got to it first. Maybe the obvious names should have been pre banned. But I don't see the issue with non-obvious names either way you're going to have to get community recommendation/popularity to determine if brandonq/xml is better or worse then parsers/xml

In ASP.NET land, I regularly work on projects where there is an informal rule that only Microsoft-published packages can be used, unless there's good reason.

You don't want to be using Ivan Vladimir's OAUTH package to sign in to Microsoft Entra ID. That probably has an FSB backdoor ready to activate. Why use that, when there's an equivalent Microsoft package?

When any random Chinese, Russian, or Israeli national can publish "microsoftauth", you just know that some idiot will use it. That idiot may be me. Or a coworker. Or a transitive dependency. Or a transitive dependency introduced after a critical update to the immediate dependency. Or an external EXE tool deployed as a part of a third-party ISV binary product. Or...

Make the only path lead to the pit of success, because the alternative is to let people wander around and fall into the pit of failure.

Re: Was Rust Worth It?

#372

Post by csomar »

Quekid5 wrote: post #369
csomar wrote: post #340

Earlier quoted context omitted.

Wait, I am a bit confused. Does Zig have more/better libraries than Rust? I thought it's a pretty new language. The most limiting thing for me with Rust was the lack of libraries (vs. say Python or Node/JavaScript).

It interops seamlessly with C libraries.

Depending on what seamlessly means, Rust can also interop with C libraries. I wrapped a bunch of them.

Re: Was Rust Worth It?

#373

Post by rustshellscript »

throwaway914 wrote: post #7

I feel like Rust finally broke the idea that programmers should be in complete control and completely conscious of everything the compiler is doing. It hasn't been that way in decades, compilers are freaking magic. But Rust undid a lot of that with borrowing. People became comfortable with the compiler knowing better than them. I just wish we could relax further: We should never be explicitly iterating forward over a…

Here: https://github.com/rust-shell-script/rust_cmd_lib

Re: Was Rust Worth It?

#374

Post by rustshellscript »

HKH2 wrote: post #157
throwaway914 wrote: post #7

I feel like Rust finally broke the idea that programmers should be in complete control and completely conscious of everything the compiler is doing. It hasn't been that way in decades, compilers are freaking magic. But Rust undid a lot of that with borrowing. People became comfortable with the compiler knowing better than them. I just wish we could relax further: We should never be explicitly iterating forward over a…

> Give me rusty bash. Bash with types (especially floats), fewer edge cases, functions with explicit parameters, simple command line flags...

You can check https://github.com/rust-shell-script/rust_cmd_lib

Re: Was Rust Worth It?

#375

Post by serial_dev »

ogoffart wrote: post #309
fawadasaurus wrote: post #103

Earlier quoted context omitted.

I did some analysis on crates.io to find the top name squatters. Then I did some calculations and found that the top name squatter created their crates at a rate of about one ever 30 seconds for a period of a week straight. I send the analysis to the crates.io team and pointed that they have a no-automation policy. They told me that it was not sufficient proof that someone was squatting those names. That's my problem…

> they have a no-automation policy What's that? I have scripts that automate publishing of new release of my crates. And I think many projects have.

Write some automated analysis that looks up popular packages on npm, pub.dev, rubygems, nuget. "Rustify" the package names. Add to it frequently used words, maybe popular names, etc. Then, write a script that creates an empty package, registers a name on crates.io every thirty seconds, and then you have about 20k package names after a week that nobody can use.

Re: Was Rust Worth It?

#376

Post by dingi »

chandlerswift wrote: post #325
estebank wrote: post #256

Earlier quoted context omitted.

80% of crates have no unsafe code in them.

I'm interested in what went into this number. I checked the six most recently published crates on crates.io (blablabla, nutp, tord, g2d, testpublishtesttest, hellochi, at the time of writing). Three of those (blablabla, testpublishtesttest, and hellochi) did some variation on printing `hello world`. g2d seems like an interesting graphics library. tord provides a data structure for transitive relations, which is also…

Don't forget to include transitive dependencies as well.

Re: Was Rust Worth It?

#377

Post by samus »

kuon wrote: post #231

I wrote a lot of rust, but after some years it still feels unproductive. I do a lot of zig now and I am like 10 times more productive with it. I can just concentrate on what I want to code and I never have to wonder what tool or what library to use. I know rust gives memory safety and how important that is, but the ergonomic is really bad. Every time I write some rust I feel limited. I always have to search libraries…

It somehow seems that Zig has most of the qualities that people like about C: clear, crisp, no huge Stdlib, good old straightforward imperative semantics, and readonably fast. But without lots of the cruft.

Re: Was Rust Worth It?

#378

Post by Animats »

Some days I have misgivings, but not about the language. About the crate situation. Too many important low-level crates stuck at 0.x. I've previously written about problems with the high-performance 3D graphics libraries, but only game devs care about those.

At the language level, the big problem is back references. Sometimes you do need them, and the only safe way to do them at present involves reference counts in the forward direction and weak references in the back direction. Then you have to call .borrow() and .upgrade() too much. I'd love to see a static analysis solution to that.

(Rough outline of such a solution: Owning object belongs to Owner trait. Owned object belongs to Owned trait. Owned object has .owner() and .owner_mut() functions which retrieve references to the owner. Owners probably have to be pinned, so they can't move while a back-reference exists. If an Owner changes a reference to an Owned object, the back reference is automatically updated.

That's the easy part. Now figure out how to prove by static analysis that a specific use of this does not violate Rust's no-aliasing rules (N read-only, or 1 mutable). This looks do-able for the non-mutable case, because having a non-mutable reference to both owned and owner is OK. Mutability, though, is tough. Anybody thinking about this?)

Re: Was Rust Worth It?

#379

Post by hutattedonmyarm »

hiAndrewQuinn wrote: post #355
pjmlp wrote: post #338

Earlier quoted context omitted.

I rather use compiled managed languages like Swift, D and C# instead, they provide enough low level coding knobs for C and C++ style coding, while being high level productive. Would add Go to the list, but only when I really have to. Nim and Crystal could be alternatives, but don't seem to have big enough communities, at least for what I do. However I do agree with the conclusion, Rust is a great language for scenari…

C# is underrated by the HN crowd, I find. I quite like how mid sized firms (100-1000 employees) use it.

Is it? Every time I see C# being mentioned here people agree how awesome it is. Not that I'm complaining, I love C#

Re: Was Rust Worth It?

#380

Post by littlestymaar »

csomar wrote: post #340
kuon wrote: post #231

I wrote a lot of rust, but after some years it still feels unproductive. I do a lot of zig now and I am like 10 times more productive with it. I can just concentrate on what I want to code and I never have to wonder what tool or what library to use. I know rust gives memory safety and how important that is, but the ergonomic is really bad. Every time I write some rust I feel limited. I always have to search libraries…

Wait, I am a bit confused. Does Zig have more/better libraries than Rust? I thought it's a pretty new language. The most limiting thing for me with Rust was the lack of libraries (vs. say Python or Node/JavaScript).

It doesn't. The ecosystem is very immature and even the official tooling is very unstable. It has a bunch of interesting design ideas but at this point it's more of an experimental language than a production ready one by most metrics. (And unless it finds some kind of corporate backing, this is unlikely to ever change).
Post reply on HN