4 ms·
It would have made it worse, because there would be 300 crates with 250 different maintainers, all pulled in by several trivial/baseline dependencies. More depe
by nullifidian 2y ago
It would have made it worse, because there would be 300 crates with 250 different maintainers, all pulled in by several trivial/baseline dependencies. More dependencies = higher the probability that a malicious maintainer has gotten maintainer's rights for one of them, especially because many original authors/maintainers of rust style microdepencency crates move on with their lives and eventually seek to exit their maintainer role. At least for classic C/C++ software, by the virtue of it being very inconvenient to casually pull 300 dependencies for something trivial, there are fewer dependencies, i.e. separate projects/repos, and these tend to be more self-contained. There are also "unserious" distributions like Fedora and something like stable/testing/unstable pipeline in Debian, which help with catching the most egregious attempts. Crates.io and npm are unserious by their very design, which is focused on maximizing growth by eliminating as many "hindrances" as possible.
- yogorenapan 2y agoWhy is rust beginning to sound like JavaScript?
- intelVISA 2y agoModern coders have been conditioned to import random libs to save 30mins work.
- joshhansen 2y agoRust specifically chose a minimal standard library to not get stuck with the Python "dead batteries" problem. There's a strong culture as well of minimizing a project's dependencies in Rust.
- account42 2y ago> Rust specifically chose a minimal standard library to not get stuck with the Python "dead batteries" problem. So has C++ in the past although there seems to be a push for a more batteries included approach recently. > There's a strong culture as well of minimizing a project's dependencies in Rust. This doesn't match what anyone can observe by looking at dependencies of Rust projects.