Re:Rust Dependencies Scare Me
by zaptheimpaler on Friday May 09, 2025 @05:58PM
(#43941299)
Because most dependencies are either manually installed by the user, or are dynamic libraries that are provided and audited by the distro maintainers. The dependencies are there, they're just harder to see - https://wiki.alopex.li/LetsBeRealAboutDependencies
[ Parent
| on HN ]
Sure, there are various dependencies, but it's nothing like "cargo install crate-name". Cargo makes it so effortless to joink the dumbest dependency for the simplest thing.
On the other hand, C/C++ makes it attractive to reinvent the wheel, or vendor the dependency instead. Rather than a single well-tested implementation in the ecosystem for something like sha256, you end up with every application having its own slightly-different, mostly untested, and essentially unmaintained version.
Applications still need the functionality. The need doesn't magically disappear when installing dependencies is a pain. If a crate has a bug, the entire ecosystem can trivially get the fixed version. If the Stackoverflow snippet a C app is vendoring has a bug, that fix is never getting in the app.
That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically link to the right libraries instead of vendoring the code. Then the library can be updated once. IMHO this is the only reasonable approach.
It's trivial to see on crates.io whether a crate is unmaintained.
Maybe if it is completely unmaintained, but this is not enough to solve the problem and maybe also not really the point.
is it trivial to see if a third level dependency is unmaintained?
Re:Rust Dependencies Scare Me
by zaptheimpaler on Friday May 09, 2025 @06:05PM
(#43941357)
Sure, I think software that's easy to use is a good thing and Rust dependency management is 100x nicer to work with than C++.
so what's the option??? I don't think this is only cargo-rust problem since you can do it too in another language
> Sure, there are various dependencies, but it's nothing like "cargo install crate-name".
You don't install a Rust crate to use it. We have enough people in this thread trying to authoritatively talk about Rust without having any experience with it, please don't bother leaving a comment if you're just going to argue from ignorance.