Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rust’s dependencies are starting to worry me

vincents.dev

Post reply on HN
Print view View original

461–470 of 593 posts

Re: Rust’s dependencies are starting to worry me

#461

Post by amelius »

dathinab wrote: post #185
amelius wrote: post #154

I think the main problem is that you should be able to run dependencies inside their own sandbox, and the language focuses only on memory safety within a monolithic program.

the problem is if you put library dependencies in their own sandbox you have a different kind of interface (much more limited) for libraries like e.g. if we look at sandbox boundaries we have: - some in language permission enforcement (e.g. Java Security Manage) -- this approach turned out to be a very bad idea - process boundaries, i.e. take the boundary the OS enforces and lock it down more (e.g. by stuff like pled…

> the problem is if you put library dependencies in their own sandbox you have a different kind of interface (much more limited) for libraries

Nobody said it would be easy. As an analogy, the borrow checker makes working with memory much more limited, yet some people like it because it makes things safer.

Re: Rust’s dependencies are starting to worry me

#462

Post by hombre_fatal »

IshKebab wrote: post #338
socalgal2 wrote: post #214

I'm curious if rust has this problem. The problem I notice in npm land is many developers have no taste. Example, there's a library for globbing call glob. You'd think it would just be a function that does globbing but no, the author decided it should ALSO be a standalone commandline executable and so includes a large commandline option parser. They could have easily made a separate commandline tool that include a li…

Yeah that's one huge advantage Rust has over NPM - Rust developers are a lot more skilled and crates are generally much higher quality.

Maybe that were true back when Rust wasn't mainstream on social media nor across tech influencer videos, but it's not true anymore.

https://crates.io/search?q=is-even

Re: Rust’s dependencies are starting to worry me

#463

Post by FredPret »

mexicocitinluez wrote: post #434
socalgal2 wrote: post #214

I'm curious if rust has this problem. The problem I notice in npm land is many developers have no taste. Example, there's a library for globbing call glob. You'd think it would just be a function that does globbing but no, the author decided it should ALSO be a standalone commandline executable and so includes a large commandline option parser. They could have easily made a separate commandline tool that include a li…

> The problem I notice in npm land is many developers have no taste. Programming is not the same as hanging out some hoity-toity art gallery. If someone critiqued my software dev by saying I had "no taste", I'd cringe so hard I'd turn into a black hole. I know this is hackernews, but this reeks of self-importance.

Engineering is a form of art where the engineer makes many decisions, large and small, where optimality cannot be proven. Taste most certainly plays a role, and there are engineering products that clearly show good or poor taste.

Unfortunately this particular art form requires fluency in mathematics and the sciences/computers, so it’s very inaccessible.

Re: Rust’s dependencies are starting to worry me

#464

Post by detaro »

hombre_fatal wrote: post #462
IshKebab wrote: post #338

Earlier quoted context omitted.

Yeah that's one huge advantage Rust has over NPM - Rust developers are a lot more skilled and crates are generally much higher quality.

Maybe that were true back when Rust wasn't mainstream on social media nor across tech influencer videos, but it's not true anymore. https://crates.io/search?q=is-even

Oh no, people in the Rust community make jokes, how unprofessional!!111

You'll notice these packages are not actually used by anything.

Re: Rust’s dependencies are starting to worry me

#465

Post by neonsunset »

iTokio wrote: post #300
WuxiFingerHold wrote: post #271

Earlier quoted context omitted.

> IMO any system where taking a dependency is "easy" and there is no penalty for size or cost is going to eventually lead to a dependency problem. Go and C# (.NET) are counterexamples. They both have great ecosystems and just as simple and effective package management as Rust or JS (Node). But neither Go or C# have issues with dependency hell like Rust or even more JavaScript, because they have exceptional std libs a…

I think this is partially true, but more nuanced than just saying that Rust std lib is lacking. Compared to go and c#, Rust std lib is mostly lacking: - a powerful http lib - serialization But Rust approach, no Runtime, no GC, no Reflection, is making it very hard to provide those libraries. Within these constraints, some high quality solutions emerged, Tokio, Serde. But they pioneered some novel approaches which wou…

To be fair I think Rust has very healthy selection of options for both, with Serde and Reqwest/Hyper being de-facto standard.

Rust has other challenges it needs to overcome but this isn't one.

I'd put Go behind both C#/F# and Rust in this area. It has spartan tooling in odd areas it's expected to be strong at like gRPC and the serialization story in Go is quite a bit more painful and bare bones compared to what you get out of System.Text.Json and Serde.

The difference is especially stark with Regex where Go ships with a slow engine (because it does not allow writing sufficiently fast code in this area at this moment) where-as both Rust and C# have top of the line implementations in each which beat every other engine save for Intel Hyperscan[0].

[0]: https://github.com/BurntSushi/rebar?tab=readme-ov-file#summa... (note this is without .NET 9 or 10 preview updates)

Re: Rust’s dependencies are starting to worry me

#466

Post by galangalalgol »

nicce wrote: post #429
ffsm8 wrote: post #420

Earlier quoted context omitted.

> “Web server” is a pretty big use case though. You don't consider games, desktop and mobile applications big use cases, each being multi billion industries? I don't know man, I feel like you're arguing in bad faith and are intentionally ignoring what the athrowaway3z said: it works there because they're essentially languages specifically made to enable web development . That's why their standard lib is plenty for th…

Web is likely bigger than all of those together. And large part of mobile and desktop apps depends on the web tech these days.

Specifically those languages are back end focused so about 28% of developers. 55 focus on front end. If you add up games desktop and mobile, oddly you get 28% as well. So not bigger but the same size good intuition! That leaves out embedded 8% and systems (8-12%). Which are probably more what rust is used for. There is obviously overlap and we haven't mentioned database or scientific programming at 12 and 5 percent respectively.

Edit: after rereading this I feel like I may have come across sarcastic, I was legitimately impressed a guess without looking it up would peg the ratio that closely. It was off topic as a response too. So I'll add that rust never would have an asynch as good as tokio, or been able to have asynch in embedded as with embassy, if it hadn't opted for batteries excluded. I think this was the right call given its initial focus as a desktop/systems language. And it is what allowed it to be more than that as people added things. Use cargo-deny, pin the oldest version that does what you need and doesn't fail cargo deny. There are several hundred crates brought in by just the rust lang repo, if you only vet things not in that list, you can save some time too.

Re: Rust’s dependencies are starting to worry me

#467

Post by buzzerbetrayed »

kibwen wrote: post #448
socalgal2 wrote: post #214

I'm curious if rust has this problem. The problem I notice in npm land is many developers have no taste. Example, there's a library for globbing call glob. You'd think it would just be a function that does globbing but no, the author decided it should ALSO be a standalone commandline executable and so includes a large commandline option parser. They could have easily made a separate commandline tool that include a li…

We don't need to speak in hypotheticals, we can just look at the glob crate: https://crates.io/crates/glob 213M downloads, depends on zero external crates, one source file (a third of which is devoted to unit tests), and developed by the rust-lang organization itself (along with a lot of crates, which is something that people tend to miss in this discussion).

Finding a single library that avoids the problem is pretty useless. You can find great libraries in Node as well but everyone would agree that Node has a dependency problem.

Re: Rust’s dependencies are starting to worry me

#468

Post by Olreich »

kazinator wrote: post #222
socalgal2 wrote: post #214

I'm curious if rust has this problem. The problem I notice in npm land is many developers have no taste. Example, there's a library for globbing call glob. You'd think it would just be a function that does globbing but no, the author decided it should ALSO be a standalone commandline executable and so includes a large commandline option parser. They could have easily made a separate commandline tool that include a li…

> Should a 'glob' library actually read the file system and give you filenames The POSIX glob function after which these things are named traverses the filesystem and matches directory entries. The pure matching function which matches a glob pattern against a filename-like string is fnmatch . But yes, the equivalent of fnmatch should be a separate module and that could be a dependency of glob. Nobody should be trying…

> But yes, the equivalent of fnmatch should be a separate module and that could be a dependency of glob.

Interesting, lets look at fnmatch: https://pubs.opengroup.org/onlinepubs/9699919799/functions/f...

Well, fnmatch really does two things, it parses the pattern and then applies that to a string, so really, there should be a "ptnparse" library that handles the pattern matching that fnmatch has a dependency.

Though, thinking it through, the "ptnparse" library is responsible for patterns matching single characters and multiple characters. We should split that up into "singleptn" and "multiptn" libraries that ptnparse can take as dependencies.

Oh, and those flags that fnmatch takes makes fnmatch work in several different ways, let's decompose those into three libraries so that we only have to pull in the matcher we care about: pthmatch, nscmatch, and prdmatch. Then we can compose those libraries based on what we want in fnmatch.

This is perfect, now if we don't care about part of the fnmatch functionality, we don't have to include it!

/s

This decomposition is how we wind up with the notorious leftpad situation. Knowing when to stop decomposing is important. fnmatch is a single function that does less than most syscalls. We can probably bundle that with a few more string functions without actually costing us a ton. Glob matching at a string level probably belongs with all the other string manipulation functions in the average "strings" library.

Importantly, my suggestion that fnmatch belongs in a "strings" library does align with your suggestion that fnmatch shouldn't be locked into a "glob" library that also includes the filesystem traversal components.

Re: Rust’s dependencies are starting to worry me

#469

Post by buzzerbetrayed »

mexicocitinluez wrote: post #434
socalgal2 wrote: post #214

I'm curious if rust has this problem. The problem I notice in npm land is many developers have no taste. Example, there's a library for globbing call glob. You'd think it would just be a function that does globbing but no, the author decided it should ALSO be a standalone commandline executable and so includes a large commandline option parser. They could have easily made a separate commandline tool that include a li…

> The problem I notice in npm land is many developers have no taste. Programming is not the same as hanging out some hoity-toity art gallery. If someone critiqued my software dev by saying I had "no taste", I'd cringe so hard I'd turn into a black hole. I know this is hackernews, but this reeks of self-importance.

Case in point.

Imagine if a carpenter or house builder was shitting out slop that had no taste. And then laughed at people who pointed it out. Would you hire them to build something for you?

This is a problem with SE culture.

Re: Rust’s dependencies are starting to worry me

#470

Post by whstl »

okanat wrote: post #406
whstl wrote: post #391

Earlier quoted context omitted.

I would say compared to other languages Rust feels even more lacking. All those AFAIR need 3rd party packages: Regex, DateTime, base64, argument parsing, url parsing, hashing, random number generation, UUIDs, JSON I'm not saying it's mandatory, but I would expect all those to be in the standard library before there is any http functionality.

Having some of those libraries listed and then not being able to change API or the implementation is what killed modern C++ adoption (along with the language being a patchwork on top of C). As some of the previous commenters said, when you focus your language to make it easy to write a specific type of program, then you make tradeoffs that can trap you in those constraints like having a runtime, a garbage collector a…

> Being able to swap out the regex, datetime, arg parsing and encoding are a feature

A feature present on every language that has those in the stdlib.

Post reply on HN