News for hackers. Stuff that matters.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by phkahler on Saturday June 13, 2020 @02:16PM (#23511404)
IMO crates are the biggest danger to Rust. It may very easily turn into the next NPM.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by saagarjha on Saturday June 13, 2020 @02:30PM (#23511509)
I think an even more problematic corollary is the desire to put nothing in the standard library, which cause the proliferation of crates that are the "standard" way of doing things but don't really have the guarantees/benefits that come with being part of "the" standard library.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by losvedir on Saturday June 13, 2020 @06:04PM (#23513198)
Yeah, I agree with this.

I see it kind of like Go's lack of generics, in a strange way. With Go, no one was explicitly "anti-generics", it's just the core team couldn't find a design they liked, and as time went on it became sort of a meme. "Go is opposed to generics." "No, here's that blog post by Russ Cox about finding a way to implement them." Etc, etc.

Similarly, the rust core team was afraid to settle on designs for certain libraries, pointing out things like python's various standard library HTTP modules, and at least "for now" shunting a lot of functionality out into the ecosystem. When you have limited manpower, this makes sense, but I think a lot of people have since rationalized that decision as philosophically the right thing to do, not just a way of prioritizing development work.

In other words, I feel like it's a case of a smart tactical decision growing into an identity.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by oefrha on Saturday June 13, 2020 @02:47PM (#23511663)
The saddest example I’ve come across so far is the lack of strftime, or any way to even print a clock time / date time in std. Even JavaScript has that. In a supposedly way past 1.0 language one has to rely on 0.x third party libraries to do even the most basic things.

Disclosure: only dabbled in Rust a bit, currently maintain two crates of some traction.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by Cyph0n on Saturday June 13, 2020 @03:03PM (#23511795)
The rand and regex crates are two other examples. I would also prefer to have bindgen in the standard library.

I’d love to use Rust in the OS I work on, but integrating our build system with Cargo and dealing with external crates is a huge obstacle.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by JoshTriplett on Saturday June 13, 2020 @04:57PM (#23512669)
> I would also prefer to have bindgen in the standard library.

That's a challenging one. I'd like to have native support for C integration as well, but we'll have to balance that with the stability of the corresponding clang interfaces, and the requirement to ship extra libraries that the Rust toolchain doesn't currently ship.

Working on it, though.

> The rand and regex crates are two other examples.

rand I'd agree with, though it would need paring down to not have as many dependencies. For regex, there are multiple tradeoffs to be made; for instance, the most popular regex crate is fast and does most of what people want but doesn't have backreferences or lookahead/lookbehind assertions.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by oefrha on Sunday June 14, 2020 @12:08AM (#23515047)
Question: is bindgen std quality yet? It seems there are still largely unsolved problems, e.g. https://github.com/rust-lang/rust-bindgen/issues/1549 which is causing hundreds of warnings in a -sys crate of mine and for which I have no recourse.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by Cyph0n on Saturday June 13, 2020 @11:52PM (#23514956)
> the requirement to ship extra libraries that the Rust toolchain doesn't currently ship.

Ah, that's something I did not consider...

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by petree on Saturday June 13, 2020 @03:53PM (#23512176)
I think the issue there is that versions are arbitrary and being able to tell when a library is 1.0 is a non-decidable problem. There are lots of 0.x crates which are stable and feel feature complete, but aren't specifically versioned as 1.0.

I would actually prefer if the Rust std would not include functionality that's not essential, for example sockets don't seem essential and the standard library does not implement them in a particularly complete and well thought out manner either IMHO.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by zozbot234 on Saturday June 13, 2020 @02:36PM (#23511565)
It would indeed be nice to have some sort of middle ground, where a selection of outstanding-quality crates can be officially "endorsed" by the Rust development team, but the endorsement can be withdrawn freely if something better comes along. C++ has something like this via Boost, and Haskell has their Haskell Platform, so it's not a new idea.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by saagarjha on Saturday June 13, 2020 @02:50PM (#23511691)
Actually, I am looking for more than this because I think Rust actually has a number of libraries that I think function fairly similarly to Boost. What I really want is the language committing to a library that is available without a third-party dependency, basically under a "linking exception" to be extremely close to "use however you want", supported by the people developing the language, designed alongside the language to remain ergonomic, with support that is tied to the language, … Personally, I consider this to be a very valuable feature from a programming language. Having a "pretty good" solution available "for free" is immensely value compared to having to go look online for every little thing, evaluate the landscape, audit it, ensure the licensing matches, consider whether will remain supported, and try to work around its idiosyncrasies.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by steveklabnik on Saturday June 13, 2020 @02:40PM (#23511607)
The Rust teams do maintain some crates outside of the standard library.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by nicoburns on Saturday June 13, 2020 @03:14PM (#23511874)
I think the proposal is specifically to bless a set of crates (that may include those developed by Rust teams, but probably also others such as regex).

Being in std implies some kind of quality standard, but it also implies no backwards incompatible changes. A set of libraries blessed by a trusted group could give you the quality standard without constraining backwards compatibility.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by steveklabnik on Saturday June 13, 2020 @03:24PM (#23511953)
Regex is one of those crates.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by jfkebwjsbx on Saturday June 13, 2020 @03:43PM (#23512108)
No, they don’t. If the Rust team maintains a crate officially and they will always do so (for reasonable values of "always"), then it is part of the standard library. Otherwise, it isn’t.

It is as simple as that. When serious, important projects depend on a standard library is because they want those guarantees. Having some members of Rust work on some crates does not give anyone those guarantees.

Which is why all those crates must be in std, or declare that the standard library is a set of crates (including core, std and others).

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by Someone on Saturday June 13, 2020 @04:56PM (#23512657)
I don’t see how that follows. Rust could easily have a (small) standard library that is guaranteed to be present everywhere and any of a number of optional libraries that are maintained by the same team that builds the compiler and the standard library.

That’s what java spent years on getting (https://www.oracle.com/corporate/features/understanding-java...), and I think that’s the way to go for any language. It prevents the standard library from bloating, yet provides quality libraries that can be trusted. It also allows some implementations to be standard without providing all the bells and whistles. That can be useful on small platforms, and allows for ‘heavier’ optional libraries (for example a SVG renderer, PDF parser, etc)

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by steveklabnik on Saturday June 13, 2020 @03:47PM (#23512131)
... I don’t see how that possibly follows. Not everything the project does is the standard library. The compiler, rustup, all kinds of tools.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by Buttons840 on Saturday June 13, 2020 @04:02PM (#23512243)
> [crates may turn into the next NPM]

Can't cargo refer to arbitrary git repos or even just plain directories? I don't see how it's any different from C or C++ in that case.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by losvedir on Saturday June 13, 2020 @06:25PM (#23513350)
It can, but then so can ruby's Bundler and elixir's Hex. But neither of them have the same issues as npm. I think npm's issues arise from a culture of making lots and lots of tiny dependencies, probably spawned by JS's anemic standard library.

At work, we have a number of Phoenix web apps with JS frontends. Looking at one randomly, there's... checking... 48 elixir dependencies and... checking... 911!! JS ones. I have to spend literally hours every week keeping those stupid JS dependencies up to date across our apps. The churn is enormous.

I think the fear is that as long as rust keeps its standard library small, a culture may develop to have more and more in the crate ecosystem, which proves to be a huge maintenance burden, as those are freer to update in breaking ways, and cross-depend on each other.

Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by jononor on Sunday June 14, 2020 @07:51AM (#23517007)
I think NPM obsession with small libraries comes from the lack of an decent optimizing compiler that can remove/not-include unused code, combined with a deployment scenario (frontend) where code size matters.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by steveklabnik on Saturday June 13, 2020 @04:09PM (#23512285)
It can, yes.
Re:Microsoft: Rust Is the Industry’s ‘Best Chance’ at Safe S... by entha_saava on Saturday June 13, 2020 @11:47PM (#23514929)
Except npm has order of magnitude more users.