Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Was Rust Worth It?

jsoverson.medium.com

Post reply on HN
Print view View original

561–570 of 736 posts

Re: Was Rust Worth It?

#561

Post by oconnor663 »

lumost wrote: post #316
goku12 wrote: post #286

Earlier quoted context omitted.

> but the ergonomic is really bad. Every time I write some rust I feel limited. > But I do not think it is a good general purpose language. Remember that this is not a sentiment that's shared by everyone. I use Rust for tasks that need anything more complicated than a shell script. Even my window manager is controlled from a Rust program. I say this as someone who has been programming in Python for nearly two decades…

I tried to get into rust for many years, I'm now in a C/CPP job (after Java/Python/Ruby and other gigs). What I've come to understand is that Rust's lifetime model is very difficult to work with whenever you have a cyclic reference. In C/CPP the same holds, but you deal with it through clever coding - or ignoring the problem and cleaning up memory later. Java, and other GC'd languages just work for these structures.…

Oh I just put up a blog post about this on Monday :)

https://jacko.io/object_soup.html

Agreed that I wish more beginner Rust books had a section about this. The pattern is quite simple, but it's hard for beginners who get stuck to realize that they need it.

Re: Was Rust Worth It?

#562

Post by epage »

bluejekyll wrote: post #272
epage wrote: post #243

Earlier quoted context omitted.

I find this interersting as most namespacing solutions would need the cargo team involved and I've heard nothing about this.

This was my first thought too. And there are a lot of questions that will get asked, like, will all crate library names start being prefixed as well? So you end up with use::bar; // changing to use::foo::bar; I assume the library names that can be overridden in cargo would still be accepted, and then it all gets a little messy. The transition would be very messy.

My preferred syntax route is a new separator in package names and the lib name gets populated by everything after it.

Still doesn't solve all of the policy problems with namespacing.

Re: Was Rust Worth It?

#563

Post by carols10cents »

jiggawatts wrote: post #370
FridgeSeal wrote: post #279

Earlier quoted context omitted.

Ok, but like, were any of them people of note, actively working on the project? Because it seems like the people who are working on the project aren’t saying that.

The people that are working on the project haven't implemented namespaces, or any other security feature really, so what they say is immaterial. What they do is the only thing that matters.

How do namespaces measurably increase security?

Re: Was Rust Worth It?

#564

Post by robertlagrant »

persnickety wrote: post #528
pizza234 wrote: post #436

Earlier quoted context omitted.

> At this point, I'm about as fast in Rust as I am in Python. This is factually impossible. For anything larger than (very) small programs, Rust requires an upfront design stage, due to ownership, that it's not required when developing in GC'ed languages. This is not even considering more local complexities, like data structures with cyclical references.

> For anything larger than (very) small programs, Rust requires an upfront design stage, due to ownership, that it's not required when developing in GC'ed languages. It's nearly the opposite. For larger programs in Python, you need an upfront design stage because the lack of static typing will allow you to organically accrete classes whose job overlap but interfaces differ. Meanwhile, Rust will smack you over the hea…

> For larger programs in Python, you need an upfront design stage because the lack of static typing will allow you to organically accrete classes whose job overlap but interfaces differ.

You can also install pre-commit and mypy, and have static typing.

Re: Was Rust Worth It?

#565

Post by carols10cents »

jiggawatts wrote: post #371
rat87 wrote: post #358

Earlier quoted context omitted.

> Extensive name squatting, to the point that virtual no library uses the obvious name, because someone else got to it first. Maybe the obvious names should have been pre banned. But I don't see the issue with non-obvious names either way you're going to have to get community recommendation/popularity to determine if brandonq/xml is better or worse then parsers/xml

In ASP.NET land, I regularly work on projects where there is an informal rule that only Microsoft-published packages can be used, unless there's good reason. You don't want to be using Ivan Vladimir's OAUTH package to sign in to Microsoft Entra ID. That probably has an FSB backdoor ready to activate. Why use that, when there's an equivalent Microsoft package? When any random Chinese, Russian, or Israeli national can…

Crates.io has publisher information-- namespacing is not required for that. For example, here are all the crates owned by the `azure` GitHub organization and published by the `azure-sdk-publish-rust` team: https://crates.io/teams/github:azure:azure-sdk-publish-rust

Re: Was Rust Worth It?

#566

Post by earthling8118 »

push-f wrote: post #288
kuon wrote: post #231

I wrote a lot of rust, but after some years it still feels unproductive. I do a lot of zig now and I am like 10 times more productive with it. I can just concentrate on what I want to code and I never have to wonder what tool or what library to use. I know rust gives memory safety and how important that is, but the ergonomic is really bad. Every time I write some rust I feel limited. I always have to search libraries…

> it can be very hard to actually know what method you can call on a struct The rust-analyzer language server can autocomplete the available methods for a value.

Furthermore you can use `cargo doc` to generate a documentation website that had everything you can do or you can use docs.rs for this. Whoever wrote this didn't embrace the tooling and just gave up.

Re: Was Rust Worth It?

#567

Post by ericbarrett »

tmtvl wrote: post #530
ericbarrett wrote: post #247

Earlier quoted context omitted.

I'm pretty shocked by the grandparent, but on reflection, I think this is the future. In The Grapes of Wrath , Steinbeck writes about the travails of a family's trip to California in search of work during the Great Depression in the 1930s. Tom Joad, the father, fixes the compression in his blown engine by wrapping a copper wire around the cylinder, then running the motor until it melts and recreates the seal. It's su…

While it's a nice story, unfortunately it would appear as though Steinbeck didn't do enough research and thought the 1925 Dodge was built much like a Model T: https://forums.aaca.org/topic/134313-the-grapes-of-wrath/ >

Hah, this is great. Guess I'm going to have to update my analogy bank.

Re: Was Rust Worth It?

#568

Post by epage »

jiggawatts wrote: post #187
muldvarp wrote: post #45

Earlier quoted context omitted.

> "We're pretending security is not an issue." has been the feedback every time this is raised with the Cargo team. Do you have a specific link where I can read this response, because this is not at all the responses I have read.

Just some random Cargo security-related issues I noticed: - No strong link between the repo and the published code. - Many crates were spammed that were just a wrapper around a popular C/C++ library. There's no indication of this, so... "surprise!"... your compiled app is now more unsafe C/C++ code than Rust. - Extensive name squatting, to the point that virtual no library uses the obvious name, because someone else…

> > "We're pretending security is not an issue." has been the feedback every time this is raised with the Cargo team.

> Do you have a specific link where I can read this response, because this is not at all the responses I have read.

Those aren't people saying security isn't an issue but examples of concerns you have which is different.

For some of those, there are reasonable improvements that can be made but will take someone having the time to do so. While the crates.io team might not be working on those specific features, I do know they are prioritizing some security related work. For instance, they recently added scoped tokens.

For some, there are trade offs to be discussed and figured out.

Re: Was Rust Worth It?

#569

Post by underdeserver »

push-f wrote: post #307
n3storm wrote: post #305

Earlier quoted context omitted.

depending on the autocompleter feels like asking to code to Chatgpt to me.

I disagree, there's a big difference: rust-analyzer is deterministic and 100% accurate while ChatGPT is non-deterministic and hallucinates.

Yep. I can't remember method names for the life of me, which is why my best experiences have been with Go and Java: The IDE (always Jetbrains) knows, via the type system, what methods I can call.

Re: Was Rust Worth It?

#570

Post by j1elo »

fawadasaurus wrote: post #103
chungy wrote: post #2

Perhaps my biggest critique is that crates.io has no namespacing. Anyone can just claim a global and generic package name and we mostly have to deal with it (unless you avoid using the crates.io repository, but then you'll probably have more problems...). Some of these globally-claimed generic packages are not really the best package to use. Maybe it was a reaction against the Java-style reverse DNS notation, which i…

I did some analysis on crates.io to find the top name squatters. Then I did some calculations and found that the top name squatter created their crates at a rate of about one ever 30 seconds for a period of a week straight. I send the analysis to the crates.io team and pointed that they have a no-automation policy. They told me that it was not sufficient proof that someone was squatting those names. That's my problem…

There's a HUGE gap between

> Using an automated tool to claim ownership of a large number of package names is not permitted.

And

- Hey, I found that someone created crates at a rate of about one every 30 seconds for a period of a week straight.

- That's not sufficient proof of squatting.

Whoever answered that, was either supporting the squatter or explicitly in favor of the practice. I cannot conceive that someone would get that evidence in their hands, and in their right mind think that the claim is bogus. Hell, I'd even be willing to suppress the squatter with evidence of one new crate created every 30 seconds for one hour!

The only reasonable conclusion to make is that they didn't really care. But then don't save face and claim that you do. That's hypocrisy.

Post reply on HN