Rust’s dependencies are starting to worry me
vincents.dev
Rust’s dependencies are starting to worry me
1–10 of 593 posts
Re: Rust’s dependencies are starting to worry me
#2[dead]
Re: Rust’s dependencies are starting to worry me
#3Similar feeling here.
Cargo makes it so simple to add tons of dependencies that it is really hard not to do it. But that does not stop here: even if I try to be careful with adding dependencies, a couple dependencies are likely to pull tens of transitive dependencies each.
"Then don't depend on them", you say. Sure, but that means I won't write my project, because I won't write those things from scratch. I could probably audit the dependency (if it wasn't pulling 50 packages itself), but I can't reasonably write it myself.
It is different with C++: I can often find dependencies that don't pull tens of transitive dependencies in C++. Maybe because it's harder to add dependencies, maybe because the ecosystem is more mature, I don't know.
But it feels like the philosophy in Rust is to pull many small packages, so it doesn't seem like it will change. And that's a pity, because I like Rust-the-language better than C++-the-language. It just feels like I trade "it's not memory-safe" for "you have to pull tons of random code from the Internet".
Re: Rust’s dependencies are starting to worry me
#4Existing discussion in https://news.ycombinator.com/item?id=43930640
Re: Rust’s dependencies are starting to worry me
#5> Many call for adding more to the rust standard library much like Go
This is the way.
Re: Rust’s dependencies are starting to worry me
#6> Many call for adding more to the rust standard library much like Go This is the way.
There should be a second stdlib with relaxed stability guarantees. Don't fill the normal stdlib full of cruft that can never be changed again.
Re: Rust’s dependencies are starting to worry me
#7Re: Rust’s dependencies are starting to worry me
#8> Many call for adding more to the rust standard library much like Go This is the way.
[deleted]
Re: Rust’s dependencies are starting to worry me
#9> Many call for adding more to the rust standard library much like Go This is the way.
The issue with that is how to get everyone to agree on how that would work, e.g. what the criteria for this extension would be, what's the policy for future changes, who will maintain all of this, etc etc.
Re: Rust’s dependencies are starting to worry me
#10> dotenv is unmaintained.
How much maintenance could you possibly need to load secrets from .env into the environment.