alt Hacker NewsRust suffers from the same faults as the JS ecosystem. Any significant crate imports hundreds if not thousands of dependencies. The probability that one of the authors gets targeted by AI-assisted attacks is just too high.
Also most of these dependencies provide a breadth of features that the end package does probably not need.
Replies
quikoa • today at 4:14 PM
A language without a large stdlib pushes this that functionality into (transitive) dependencies. I hope more language will adopt batteries included approach.
➕ show 1 reply
rfgplk • today at 7:15 PM
Yep. Sorry for the spam, but look at this, compiling "yazi" from source (ie a relatively simple TUI file manager) 676 dependencies:
Downloaded by_address v1.2.1
Downloaded block-buffer v0.12.1
Downloaded block-padding v0.4.2
Downloaded adler2 v2.0.1
Downloaded color_quant v1.1.0
Downloaded blowfish v0.10.0
Downloaded byteorder v1.5.0
Downloaded bytemuck_derive v1.12.0
Downloaded futures-sink v0.3.34
Downloaded bs58 v0.5.1
Downloaded critical-section v1.2.0
Downloaded fnv v1.0.7
Downloaded bytemuck v1.25.2
Downloaded form_urlencoded v1.2.2
Downloaded futures-macro v0.3.34
Downloaded futures-io v0.3.34
Downloaded blake2 v0.11.0-rc.6
Downloaded find-msvc-tools v0.1.11
Downloaded funty v2.0.0
Downloaded fdlimit v0.3.0
Downloaded ff v0.14.0
Downloaded foldhash v0.2.0
Downloaded bon v3.9.3
Downloaded fdeflate v0.3.7
Downloaded darling_core v0.23.0
Downloaded bon-macros v3.9.3 account42 • today at 3:56 PM
Yes, the lack of a language package manager for older programming languages is a feature.
My experience has been that it has a major advantage, in that freeze + offline actually work properly. You can collect the dependencies you need once, put them in version control and never ever talk to remote registry again