Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rust’s dependencies are starting to worry me

vincents.dev

Post reply on HN
Print view View original

451–460 of 593 posts

Re: Rust’s dependencies are starting to worry me

#451

Post by skydhash »

jampekka wrote: post #193
ChocolateGod wrote: post #173

Earlier quoted context omitted.

There's examples of maintainers/packagers effectively sabotaging other peoples projects when making packages for distros, whether that's shipping them broken, ancient versions etc. e.g. Bottles, WebkitGTK (distros liked keeping this one held back even though doing so is a security risk) IMHO it shouldn't be the responsibility of the OS vendor to package third party applications.

Distro maintainers/packagers are who keep the current software stacks running. It's rather amazing how they manage to keep the billion or so lines of separately written code working in unison. That said, the labor needed to keep the stuff together could be reduced a lot by the more ergonomical and universal packaging and distribution methods like Cargo (and, dare I say, npm). I think some kind of a better bridge betw…

> I think some kind of a better bridge between developers and distros could be found here.

I don’t think there’s a need to do so. Only discipline is needed, by using stable and mature dependencies, and documenting the building process. And maybe some guides/scripts for the most popular distros.

Re: Rust’s dependencies are starting to worry me

#452

Post by zahlman »

nicce wrote: post #432
zahlman wrote: post #275

Earlier quoted context omitted.

>A great std lib is obviously the solution. Some Rust defenders are talking it down by giving Python as counter example. Python's standard library is big . I wouldn't call it great, because Python is over 30 years old and it's hard to add things to a standard library and even harder to remove them.

Maybe Python 4 will just remove stuff.

My personal language design is strongly inspired by what I imagine a Python 4 would look like (but also takes hints from other languages, and some entirely new ideas that wouldn't fit neatly in Python).

Re: Rust’s dependencies are starting to worry me

#453

Post by hu3 »

kibwen wrote: post #448
socalgal2 wrote: post #214

I'm curious if rust has this problem. The problem I notice in npm land is many developers have no taste. Example, there's a library for globbing call glob. You'd think it would just be a function that does globbing but no, the author decided it should ALSO be a standalone commandline executable and so includes a large commandline option parser. They could have easily made a separate commandline tool that include a li…

We don't need to speak in hypotheticals, we can just look at the glob crate: https://crates.io/crates/glob 213M downloads, depends on zero external crates, one source file (a third of which is devoted to unit tests), and developed by the rust-lang organization itself (along with a lot of crates, which is something that people tend to miss in this discussion).

glob was just an example. They weren't asking about a specific crate.

Also this crate is from official rust lang repo, so much less prone to individualistic misbehaving. A bad example all around.

Re: Rust’s dependencies are starting to worry me

#454

Post by [deleted] »

hu3 wrote: post #453
kibwen wrote: post #448

Earlier quoted context omitted.

We don't need to speak in hypotheticals, we can just look at the glob crate: https://crates.io/crates/glob 213M downloads, depends on zero external crates, one source file (a third of which is devoted to unit tests), and developed by the rust-lang organization itself (along with a lot of crates, which is something that people tend to miss in this discussion).

glob was just an example. They weren't asking about a specific crate. Also this crate is from official rust lang repo, so much less prone to individualistic misbehaving. A bad example all around.

[deleted]

Re: Rust’s dependencies are starting to worry me

#455

Post by hombre_fatal »

kibwen wrote: post #448
socalgal2 wrote: post #214

I'm curious if rust has this problem. The problem I notice in npm land is many developers have no taste. Example, there's a library for globbing call glob. You'd think it would just be a function that does globbing but no, the author decided it should ALSO be a standalone commandline executable and so includes a large commandline option parser. They could have easily made a separate commandline tool that include a li…

We don't need to speak in hypotheticals, we can just look at the glob crate: https://crates.io/crates/glob 213M downloads, depends on zero external crates, one source file (a third of which is devoted to unit tests), and developed by the rust-lang organization itself (along with a lot of crates, which is something that people tend to miss in this discussion).

Which glob crate? https://crates.io/search?q=glob

I went to page 8 and there were still glob libraries.

Re: Rust’s dependencies are starting to worry me

#456

Post by pas »

timewizard wrote: post #73
nemothekid wrote: post #43

I feel like leftpad has given package managers a very bad name. I understand the OP's hesitation, but it feels a little ridiculous to me. tokio is a work-stealing, asynchronous runtime. This is a feature that would be an entire language . Does OP consider it reasonable to audit the entire Go language? or the V8 engine for Node? v8 is ~10x more lines than tokio. If Cloudflare uses Node, would you expect Cloudflare to…

If two different dependencies use a different version of some other dependency between them does cargo still include both versions by default? This is something I've only ever seen cargo do.

> This is something I've only ever seen cargo do.

npm does this (which causes [caused?] the node_modules directory to have a megazillion of files usually, but sometimes "hoisting" common dependencies helps, and there's Yarn's PnP [which hooks into Node's require() and keeps packages as ZIPs], and pnpm uses symlinks/hardlinks)

Re: Rust’s dependencies are starting to worry me

#457

Post by zahlman »

scripturial wrote: post #298
zahlman wrote: post #274

Earlier quoted context omitted.

> The only real solution I can think of to deal with this long term is ultra-fine-grained symbols and dependencies. Every function, type, and other top-level language construct needs to declare the set of things it needs to run (other functions, symbols, types, etc). When you depend on that one symbol it can construct, on demand, the exact graph of symbols it needs and dump the rest for any given library. You end up…

If you think about it, every function already declares what it needs simply by actually using it. You know if a function needs another function because it calls it. So what exactly are you asking? That the programmer insert a list of dependent functions in a comment above every function? The compiler could do that for you. The compiler could help you and go up a level and insert the names of modules the functions bel…

My understanding is that the existing algorithms for tree shaking (dead code elimination, etc. etc. whatever you want to call it) work exactly on that basis. But Python is too dynamic to just read the source code and determine what's used ahead of time. eval and exec exist; just about every kind of namespace is reflected as either a dictionary or an object with attributes, and most are mutable; and the import system works purely at runtime and has a dazzling array of hooks.

Re: Rust’s dependencies are starting to worry me

#458

Post by sseagull »

PoignardAzur wrote: post #388
kion wrote: post #85

IMO any system where taking a dependency is "easy" and there is no penalty for size or cost is going to eventually lead to a dependency problem. That's essentially where we are today both in language repositories for OSS languages and private monorepos. This is partly due to how we've distributed software over the last 40 years. In the 80s the idea of a library of functionality was something you paid for, and painsta…

> At each level a caller might need 5% of the functionality of any given dependency. The deeper the dependency tree gets the more waste piles on. Eventually you end up in a world where your simple binary is 500 MiB of code you never actually call, but all you did was take that one dependency to format a number. I'm not convinced that happens that often. As someone working on a Rust library with a fairly heavy depende…

Not in Rust, but I've seen it with Python in scientific computing. Someone needs to do some minor matrix math, so they install numpy. Numpy isn't so bad, but if installing it via conda it pulls in MKL, which sits at 171MB right now (although I have memories of it being bigger in the past). It also pulls in intel-openmp, which is 17MB.

Just so you can multiply matrices or something.

Re: Rust’s dependencies are starting to worry me

#459

Post by dgb23 »

ffsm8 wrote: post #420
dgb23 wrote: post #380

Earlier quoted context omitted.

“Web server” is a pretty big use case though. But I agree that graphics is often overlooked in std libs. However that’s a bit of a different beast. Std libs typically deal with what the OS provides. Graphics is its own world so to speak. As for Wasm: first, that’s a runtime issue and not a language issue. I think GC is on the roadmap for Wasm. Second, Go and C# obviously predate Wasm. In the end, not every language s…

> “Web server” is a pretty big use case though. You don't consider games, desktop and mobile applications big use cases, each being multi billion industries? I don't know man, I feel like you're arguing in bad faith and are intentionally ignoring what the athrowaway3z said: it works there because they're essentially languages specifically made to enable web development . That's why their standard lib is plenty for th…

> but the thesis of a large standard lib solving the dependency issue really isnt true, as (almost) every other usecase beyond web development shows.

I don't think the dependency issue can be solved by a good std lib, but it certainly can be mitigated as some languages show.

I think JS is a very pronounced case study here.

Re: Rust’s dependencies are starting to worry me

#460

Post by [deleted] »

dgb23 wrote: post #459
ffsm8 wrote: post #420

Earlier quoted context omitted.

> “Web server” is a pretty big use case though. You don't consider games, desktop and mobile applications big use cases, each being multi billion industries? I don't know man, I feel like you're arguing in bad faith and are intentionally ignoring what the athrowaway3z said: it works there because they're essentially languages specifically made to enable web development . That's why their standard lib is plenty for th…

> but the thesis of a large standard lib solving the dependency issue really isnt true, as (almost) every other usecase beyond web development shows. I don't think the dependency issue can be solved by a good std lib, but it certainly can be mitigated as some languages show. I think JS is a very pronounced case study here.

[deleted]
Post reply on HN