5 ms·

This is my largest issue with Rust right now too. I’m happy to use it for personal projects on my own computer, but I don’t feel comfortable shipping a huge pi

by panic 5y ago

This is my largest issue with Rust right now too. I’m happy to use it for personal projects on my own computer, but I don’t feel comfortable shipping a huge pile of code I don’t really understand onto someone else’s computer. I trust a self-contained standard library (like those distributed with Go and Python) much more than a patchwork of packages that depend on other packages, written by many different people, and which may be in different states of maintained, unmaintained, have security holes… putting my name on software based on these packages means taking responsibility for all that mess.

kaidon 5y ago
All valid concerns -- but you have to worry about bringing in other code in your supply chain in almost any language, unless you are always doing everything from scratch! Thank goodness cargo audit (for https://crates.io/crates/cargo-audit https://crates.io/crates/cargo-audit) in any case.
nine_k 5y ago
> shipping a huge pile of code I don’t really understand Isn't this right for any language, though?
- Ygg2 5y ago
  Yes. One glance at Log4j fiasco shows no one really understood all of the code.
  - GuB-42 5y ago
    Log4j is not a standard library, it is just very popular, and it proves the original concern. It is treated as standard but it is not, and package muddle the waters even more. Remember leftPad. The lack of a stable ABI is also a problem. For example, on my Linux distro, if a library has a bug, I just update the library and all software using it are fixed. No need to recompile everything. So, essentially, the cargo system makes it easy to import weak code and hard to fix it later. I am not saying that cargo is terrible, but it is a problem with rust that is not to be dismissed.
    - Ygg2 5y ago
      It still doesn't negate my point. You need to rely on other people's code. Whether it std lib or not. Left pad is because of: A) ease of modularization B) problems with tree shaking C) people want small easily understandable library Which tbh works more often than not. ---- Stable ABI is a curse as much as blessing. Once you have stable ABI, you will never want to break it. Even if breaking ABI would be beneficial long term. See https://cor3ntin.github.io/posts/abi/ https://cor3ntin.github.io/posts/abi/ And if you desire Stable ABI there is option of exposing C API in Rust. ---- > So, essentially, the cargo system makes it easy to import weak code and hard to fix it later. Hard for who? Cargo can easily fork a package and recompile it. It makes it harder for distros. But you can ship static linked dependencies, easily.

by panic 5y ago

kaidon 5y ago

All valid concerns -- but you have to worry about bringing in other code in your supply chain in almost any language, unless you are always doing everything from scratch! Thank goodness cargo audit (for https://crates.io/crates/cargo-audit https://crates.io/crates/cargo-audit) in any case.

nine_k 5y ago

> shipping a huge pile of code I don’t really understand Isn't this right for any language, though?

Ygg2 5y ago
Yes. One glance at Log4j fiasco shows no one really understood all of the code.
- GuB-42 5y ago
  Log4j is not a standard library, it is just very popular, and it proves the original concern. It is treated as standard but it is not, and package muddle the waters even more. Remember leftPad. The lack of a stable ABI is also a problem. For example, on my Linux distro, if a library has a bug, I just update the library and all software using it are fixed. No need to recompile everything. So, essentially, the cargo system makes it easy to import weak code and hard to fix it later. I am not saying that cargo is terrible, but it is a problem with rust that is not to be dismissed.
  - Ygg2 5y ago
    It still doesn't negate my point. You need to rely on other people's code. Whether it std lib or not. Left pad is because of: A) ease of modularization B) problems with tree shaking C) people want small easily understandable library Which tbh works more often than not. ---- Stable ABI is a curse as much as blessing. Once you have stable ABI, you will never want to break it. Even if breaking ABI would be beneficial long term. See https://cor3ntin.github.io/posts/abi/ https://cor3ntin.github.io/posts/abi/ And if you desire Stable ABI there is option of exposing C API in Rust. ---- > So, essentially, the cargo system makes it easy to import weak code and hard to fix it later. Hard for who? Cargo can easily fork a package and recompile it. It makes it harder for distros. But you can ship static linked dependencies, easily.