Rust’s dependencies are starting to worry me • Hacker News Board

Re: Rust’s dependencies are starting to worry me

#491

Post by oddmiral » Sat, May 10, 2025, 3:20 PM UTC

whstl wrote: post #391

iTokio wrote: post #300

Earlier quoted context omitted.

I think this is partially true, but more nuanced than just saying that Rust std lib is lacking. Compared to go and c#, Rust std lib is mostly lacking: - a powerful http lib - serialization But Rust approach, no Runtime, no GC, no Reflection, is making it very hard to provide those libraries. Within these constraints, some high quality solutions emerged, Tokio, Serde. But they pioneered some novel approaches which wou…

I would say compared to other languages Rust feels even more lacking. All those AFAIR need 3rd party packages: Regex, DateTime, base64, argument parsing, url parsing, hashing, random number generation, UUIDs, JSON I'm not saying it's mandatory, but I would expect all those to be in the standard library before there is any http functionality.

Create a new library, name it as "Standard library", include and reexport al those libraries, profit.

Re: Rust’s dependencies are starting to worry me

#492

Post by whstl » Sat, May 10, 2025, 3:21 PM UTC

mplanchard wrote: post #489

whstl wrote: post #470

Earlier quoted context omitted.

> Being able to swap out the regex, datetime, arg parsing and encoding are a feature A feature present on every language that has those in the stdlib.

Not necessarily, when other components of the stdlib depend on them

Also not necessarily with third-party libraries.

Re: Rust’s dependencies are starting to worry me

#493

Post by kibwen » Sat, May 10, 2025, 3:21 PM UTC

harha_ wrote: post #129

zaptheimpaler wrote: post #124

Earlier quoted context omitted.

Because most dependencies are either manually installed by the user, or are dynamic libraries that are provided and audited by the distro maintainers. The dependencies are there, they're just harder to see - https://wiki.alopex.li/LetsBeRealAboutDependencies

Sure, there are various dependencies, but it's nothing like "cargo install crate-name". Cargo makes it so effortless to joink the dumbest dependency for the simplest thing.

> Sure, there are various dependencies, but it's nothing like "cargo install crate-name".

You don't install a Rust crate to use it. We have enough people in this thread trying to authoritatively talk about Rust without having any experience with it, please don't bother leaving a comment if you're just going to argue from ignorance.

Re: Rust’s dependencies are starting to worry me

#494

Post by mplanchard » Sat, May 10, 2025, 3:22 PM UTC

okanat wrote: post #406

whstl wrote: post #391

Earlier quoted context omitted.

I would say compared to other languages Rust feels even more lacking. All those AFAIR need 3rd party packages: Regex, DateTime, base64, argument parsing, url parsing, hashing, random number generation, UUIDs, JSON I'm not saying it's mandatory, but I would expect all those to be in the standard library before there is any http functionality.

Having some of those libraries listed and then not being able to change API or the implementation is what killed modern C++ adoption (along with the language being a patchwork on top of C). As some of the previous commenters said, when you focus your language to make it easy to write a specific type of program, then you make tradeoffs that can trap you in those constraints like having a runtime, a garbage collector a…

Yeah I’ve encountered the benefit of this approach recently when writing WASM binaries for the web, where binary size becomes something we want to optimize for.

The de facto standard regex library (which is excellent!) brings in nearly 2 MB of additional content for correct unicode operations and other purposes. The same author also makes regex-lite, though, which did everything we need, with the same interface, in a much smaller package. It made it trivial to toss the functionality we needed behind a trait and choose a regex library appropriately in different portions of our stack.

Re: Rust’s dependencies are starting to worry me

#495

Post by mplanchard » Sat, May 10, 2025, 3:23 PM UTC

whstl wrote: post #492

mplanchard wrote: post #489

Earlier quoted context omitted.

Not necessarily, when other components of the stdlib depend on them

Also not necessarily with third-party libraries.

True! Although it’s easier to swap out a third party lib that’s using a bloated dependency than it is to avoid something in std.

Re: Rust’s dependencies are starting to worry me

#496

Post by whstl » Sat, May 10, 2025, 3:23 PM UTC

oddmiral wrote: post #491

whstl wrote: post #391

Earlier quoted context omitted.

I would say compared to other languages Rust feels even more lacking. All those AFAIR need 3rd party packages: Regex, DateTime, base64, argument parsing, url parsing, hashing, random number generation, UUIDs, JSON I'm not saying it's mandatory, but I would expect all those to be in the standard library before there is any http functionality.

Create a new library, name it as "Standard library", include and reexport al those libraries, profit.

This won't solve supply chain issues.

Re: Rust’s dependencies are starting to worry me

#497

Post by IshKebab » Sat, May 10, 2025, 3:23 PM UTC

hombre_fatal wrote: post #462

IshKebab wrote: post #338

Earlier quoted context omitted.

Yeah that's one huge advantage Rust has over NPM - Rust developers are a lot more skilled and crates are generally much higher quality.

Maybe that were true back when Rust wasn't mainstream on social media nor across tech influencer videos, but it's not true anymore. https://crates.io/search?q=is-even

That's a joke. Leftpad wasn't.

Re: Rust’s dependencies are starting to worry me

#498

Post by ThouYS » Sat, May 10, 2025, 3:28 PM UTC

I'm using fewer and fewer libs, thanks to ChatGPT. Just write me whichever function I currently need

Re: Rust’s dependencies are starting to worry me

#499

Post by dsr_ » Sat, May 10, 2025, 3:39 PM UTC

sunrunner wrote: post #89

dsr_ wrote: post #44

Earlier quoted context omitted.

s/Best way/The only safe way/ Anything else will get abused in the name of expediency and just-this-one-time. Also, the process for adding a crate/gem/module/library needs to be the same as anything else: license review, code review, subscription to the appropriate mailing list or other announce channel, and assignment of responsibility. All of these except code review can be really, really fast once you have the pro…

I agree that some amount of friction when including third party dependencies is a vital thing to push people to consider the value versus cost of dependencies (and license review, code review, channel subscriptions are all incredibily important and almost always overlooked), however how should this work for transitive dependendencies? And the dependencies of _those_ dependencies? The dependency trees for most interpr…

You understand the problem clearly, but you haven't put your finger on the solution.

It's an obvious one, but distasteful to many people.

Re: Rust’s dependencies are starting to worry me

#500

Post by iainmerrick » Sat, May 10, 2025, 3:44 PM UTC

No mention here of binary size (beyond linking out to a ClickHouse blog post on the topic).

The total number of lines of code is relevant, sure, but for most practical purposes, compile times and binary sizes are more important.

I don't know the situation in Rust, but in JS land, there's a pretty clear divide between libraries that are tree-shakable (or if you prefer, amenable to dead code elimination) and those that aren't. If you stick to tree-shakable dependencies your final bundled output will only include what you actually need and can be pretty small.