Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rust’s dependencies are starting to worry me

vincents.dev

Post reply on HN
Print view View original

131–140 of 593 posts

Re: Rust’s dependencies are starting to worry me

#131

Post by cyberax »

jerf wrote: post #29

A true enough statement, but "Rust" is unnecessarily specific. Dependencies are getting scary in general. Supply chain attacks are no longer hypothetical, they're here and have been for a while. If I were designing a new language I think I'd be very interested in putting some sort of capability system in so I can confine entire library trees safely, and libraries can volunteer somehow what capabilities they need/offe…

TypeScript ecosystem supports this! An environment without e.g. file operations will simply miss classes that are needed for it, and your compilation will fail.

Re: Rust’s dependencies are starting to worry me

#132

Post by pjmlp »

assassinator42 wrote: post #95
jerf wrote: post #29

A true enough statement, but "Rust" is unnecessarily specific. Dependencies are getting scary in general. Supply chain attacks are no longer hypothetical, they're here and have been for a while. If I were designing a new language I think I'd be very interested in putting some sort of capability system in so I can confine entire library trees safely, and libraries can volunteer somehow what capabilities they need/offe…

Java and the .NET Framework had partial trust/capabilities mechanisms decades ago. No one really used them and they were deprecated/removed.

It was more like no one used them correctly.

Re: Rust’s dependencies are starting to worry me

#133

Post by martsa1 »

0cf8612b2e1e wrote: post #99
jerf wrote: post #29

A true enough statement, but "Rust" is unnecessarily specific. Dependencies are getting scary in general. Supply chain attacks are no longer hypothetical, they're here and have been for a while. If I were designing a new language I think I'd be very interested in putting some sort of capability system in so I can confine entire library trees safely, and libraries can volunteer somehow what capabilities they need/offe…

Is there anything in existence which has a version of this idea? It makes a ton of sense to me, but you are right that it would be practically impossible to do in a current language.

Wasm + wasi let you define hard boundaries between components with explicit interfaces, might be loosely along these lines?

Re: Rust’s dependencies are starting to worry me

#134

Post by SamuelAdams »

kion wrote: post #85

IMO any system where taking a dependency is "easy" and there is no penalty for size or cost is going to eventually lead to a dependency problem. That's essentially where we are today both in language repositories for OSS languages and private monorepos. This is partly due to how we've distributed software over the last 40 years. In the 80s the idea of a library of functionality was something you paid for, and painsta…

This idea is already implemented in Dotnet, with Trimming and now ahead of time compilation (AOT). Maybe other languages can learn from dotnet?

https://learn.microsoft.com/en-us/dotnet/core/deploying/trim...

https://learn.microsoft.com/en-us/dotnet/core/deploying/nati...

Re: Rust’s dependencies are starting to worry me

#135

Post by pjmlp »

MeetingsBrowser wrote: post #79
pjmlp wrote: post #32

Earlier quoted context omitted.

Best way is to have CI/CD systems only connected to the official internal repos. Devs can add whatever they feel like on their workstations but it will be a sad build server if they get pushed without permission.

> Devs can add whatever they feel like on their workstations A compromised dev machine is also a problem.

True, hence we can go next level and also deal with limited accounts for developers, and I can tell you most folks on HN would hate to work in such corporate environments.

Re: Rust’s dependencies are starting to worry me

#136

Post by pjmlp »

eddd-ddde wrote: post #68
neilv wrote: post #19

In the past (not in Rust, but other languages), for important systems, I've instituted policies of minimizing dependencies from these language-specific package repositories, and for the ones you do use, having to copy it to our own repos and audit each update before use. But that's not practical for all situations. For example, Web frontend developer culture might be the worst environment, to the point you often can'…

The cool thing about rust is you can implement async yourself. You aren't tied to any specific implementation.

Same in C++, partially true in .NET/C# and F#.

Re: Rust’s dependencies are starting to worry me

#137

Post by zaptheimpaler »

harha_ wrote: post #129
zaptheimpaler wrote: post #124

Earlier quoted context omitted.

Because most dependencies are either manually installed by the user, or are dynamic libraries that are provided and audited by the distro maintainers. The dependencies are there, they're just harder to see - https://wiki.alopex.li/LetsBeRealAboutDependencies

Sure, there are various dependencies, but it's nothing like "cargo install crate-name". Cargo makes it so effortless to joink the dumbest dependency for the simplest thing.

Sure, I think software that's easy to use is a good thing and Rust dependency management is 100x nicer to work with than C++.

Re: Rust’s dependencies are starting to worry me

#138

Post by QuadmasterXLII »

I wonder how much good a “dependency depth” label on packages would do, at the crates.io level. Like, a package can only depend on a package with a lower declared dependency depth than it, and packages compete to have a low dependency depth as a badge.

Re: Rust’s dependencies are starting to worry me

#139

Post by tialaramex »

xlii wrote: post #94
kion wrote: post #85

IMO any system where taking a dependency is "easy" and there is no penalty for size or cost is going to eventually lead to a dependency problem. That's essentially where we are today both in language repositories for OSS languages and private monorepos. This is partly due to how we've distributed software over the last 40 years. In the 80s the idea of a library of functionality was something you paid for, and painsta…

> Go and Rust, for example, encourage everything for a single package/mod to go in the same file. Clarification: Go allows for a very simple multi-file. It’s one feature I really like, because it allows splitting otherwise coherent module into logical parts.

Yeah, likewise Rust is completely fine after you say `mod foo` and have a file named foo.rs, if you also make a foo/ directory and put foo/whatever.rs and foo/something_else.rs that those are all part of the foo module.

Historically Rust wanted that foo.rs to be renamed foo/mod.rs but that's no longer idiomatic although of course it still works if you do that.

Re: Rust’s dependencies are starting to worry me

#140

Post by im3w1l »

prophesi wrote: post #36
klooney wrote: post #10

> dotenv is unmaintained. How much maintenance could you possibly need to load secrets from .env into the environment.

The maintainers themselves give this warning in the repo's README, so even if it were maintained, it still wouldn't be production ready. > Achtung! This is a v0.* version! Expect bugs and issues all around. Submitting pull requests and issues is highly encouraged! https://github.com/dotenv-rs/dotenv

Ironically a project that hasn't been changed in a while "unmaintained" is a good candidate for bumping to v1, while a project with new breaking commits every day is a bad candidate.
Post reply on HN