Rewriting Sysctl(8) in Rust: Systeroid

Re:Rewriting Sysctl(8) in Rust: Systeroid by pohl on Tuesday April 19, 2022 @10:02AM (#31083226)

I see no reason why library authors should be expected to document this when the actual source of truth — the Cargo.toml file — is sitting right there and will never be wrong. If you want to see the transitive dependencies, all you need is to run "cargo tree".

Both crates.io and lib.rs surface this automatically right there on the crate's page.

The rust "culture" on transitive dependencies is actually laudably transparent: it's built right into the tools.

[ Parent | on HN ]

Re:Rewriting Sysctl(8) in Rust: Systeroid by pjmlp on Tuesday April 19, 2022 @12:19PM (#31085249)

Same can be told about npm, and I hardly see anyone jump of joy regarding it.

[ Parent | on HN ]

Re:Rewriting Sysctl(8) in Rust: Systeroid by jrockway on Tuesday April 19, 2022 @01:33PM (#31086188)

I mean, the number of dependencies a node project uses doesn't really affect me. If they have 1 or if they have 1 million, it's the same "npm install" command.

I personally like to keep third-party dependencies as minimal as possible, mostly to avoid getting 8 emails a day from dependabot telling me that a dependency of a dependency of a dependency has a regex denial of service attack and some dependency in the middle has a massive breaking change that prevents another dependency from being upgraded to include the fix. (Nevermind that I'm using it on the frontend, so if a user picks a bad regex they will slow down their own browser and nobody else's.)

[ Parent | on HN ]

Re:Rewriting Sysctl(8) in Rust: Systeroid by gspr on Wednesday April 20, 2022 @03:33AM (#31093860)

> If they have 1 or if they have 1 million, it's the same "npm install" command.

Only if you accept one single, unflexible way of installing the software.

[ Parent | on HN ]