11–20 of 71 posts
It's quite an, ahem, interesting mix of libraries, including three csv libraries, hyper_utils (but not hyper itself), and a ton of copied crates from other maintainers.
I hope the author has a good way of updating these with upstream fixes (some look out-of-date already), otherwise you may replace one security issue with another.
And the name stdx has been taken on crates.io, more than 11 years ago which can also be equally confusing.
1. What problem does stdx actually solve?
2. Ok, it's a git dep, seems fine? Why is the choice to publish or not publish in crates.io a big deal either way?
It just looks like stdx has copied stuff from crates and put it in a git repo. It feels like this is worse than a package manager? As in why would I trust a random git repo to keep things up to date over the officially published channel?
Looks like it's that, plus vibe coding (in areas like crypto!) - https://kerkour.com/stdx
(I’m more worried about judgement calls than implementation correctness, it’s not about AI.)
It just looks like stdx has copied stuff from crates and put it in a git repo. It feels like this is worse than a package manager? As in why would I trust a random git repo to keep things up to date over the officially published channel?
base64 = { git = "https://github.com/rust-stdx/stdx", rev = "" }> Also, you can only create a crates.io account with a GitHub account Oh is that true? They tied themselves to Microsoft it seems. What about people who won't or can't use GitHub.
What in my opinion is unacceptable is that it requires you to give permission to "read your organization and team membership and private Projects".
I made a separate GitHub account (weinzierl-trusted-publisher) for crates.io which is far from ideal, because it works completely against the idea to build trust for a single unified identity online, but ¯\(ツ)/¯.
It just looks like stdx has copied stuff from crates and put it in a git repo. It feels like this is worse than a package manager? As in why would I trust a random git repo to keep things up to date over the officially published channel?
Plus, with forks anyone can publish a commit accessible from the main repo, so one could disguise a malicious version of stdx by forking the repo, pushing their charges, then setting the rev: base64 = { git = "https://github.com/rust-stdx/stdx", rev = " " }
The other reason I don’t trust them is because this repo is 100% AI slop, even for crypto code. He posted it on /r/rust where every comment was highly negative - https://www.reddit.com/r/rust/s/4I4Xc7x7ec. The thread was removed by a moderator with the note:
Please, stop posting articles from kerkour.com.
The blog has been on a downward spiral for years, it's doomed, let it go.
Earlier quoted context omitted.
Looks like it's that, plus vibe coding (in areas like crypto!) - https://kerkour.com/stdx
Uh, yeah, this is not the writing of someone with the experience to maintain a cryptography toolkit: https://kerkour.com/nist-cryptography-backdoor (I’m more worried about judgement calls than implementation correctness, it’s not about AI.)
> Also, you can only create a crates.io account with a GitHub account Oh is that true? They tied themselves to Microsoft it seems. What about people who won't or can't use GitHub.
Keep in mind that all of rustc and libs development takes place on Github.
It just looks like stdx has copied stuff from crates and put it in a git repo. It feels like this is worse than a package manager? As in why would I trust a random git repo to keep things up to date over the officially published channel?
The big question about this project isn't its distribution, it's the core question it posed when it was first announced: are Rust developers going to seriously entertain an alternative "standard library" curated by one developer.
Also Debian tries to build and distribute independently from crates.io.
So crates.io is important but is not the (Rust) world.