2 ms·

> Finally, Cargo to my knowledge actually lets multiple dependencies exist That's a bug, not a feature. It enables sloppy development and the disasters like on

> Finally, Cargo to my knowledge actually lets multiple dependencies exist That's a bug, not a feature. It enables sloppy development and the disasters like on NPM

wtetzner 6y ago
How so? The version ends up being part of the type, so a type from two different versions of a given package are not compatible, which solves most if not all of the issues. If a package is just using a particular library internally, I don’t see why the package manager should prevent using it with another library that depends on a different version.
- throwaway129013 6y ago
  > I don’t see why the package manager should prevent using it with another library that depends on a different version. I do. The main reason for Linux distributions to exists is to provide a development and running environment where: - API/ABIs do not change for the whole lifetime of the distribution. No new features, no new bugs, no new vulnerabilities, so that your production code can run reliably for 5+ years. - Vulnerabilities are fixed with minimally invasive patches. - Vulnerabilities are fixed in reasonable times even if the upstream development stopped. Patches are well tested against the set of packages in the distribution. You simply cannot have these 3 features together if a distribution ships 10 different version of each library. It's already a ton of work to maintain packages in stable distributions.
  - wtetzner 6y ago
    I’m confused by your comment. This is about a programming language package manager, not an OS package manager. Or was that just an example?
vlovich123 6y ago
As I said above: > Now whether or not it's a good idea to support this kind of dependency stuff can be controversial. In practice though clearly it does cause problems the larger your codebase gets as you're more likely to have some nested dependency chain that's time-consuming to upgrade so you'd rather move faster than make sure you're only running 1 version of the dependency. Consider the view that some times it can be sloppy & other times it's not & it's impossible to distinguish between the two in an automated fashion.

> Finally, Cargo to my knowledge actually lets multiple dependencies exist That's a bug, not a feature. It enables sloppy development and the disasters like on NPM

wtetzner 6y ago

How so? The version ends up being part of the type, so a type from two different versions of a given package are not compatible, which solves most if not all of the issues. If a package is just using a particular library internally, I don’t see why the package manager should prevent using it with another library that depends on a different version.

throwaway129013 6y ago
> I don’t see why the package manager should prevent using it with another library that depends on a different version. I do. The main reason for Linux distributions to exists is to provide a development and running environment where: - API/ABIs do not change for the whole lifetime of the distribution. No new features, no new bugs, no new vulnerabilities, so that your production code can run reliably for 5+ years. - Vulnerabilities are fixed with minimally invasive patches. - Vulnerabilities are fixed in reasonable times even if the upstream development stopped. Patches are well tested against the set of packages in the distribution. You simply cannot have these 3 features together if a distribution ships 10 different version of each library. It's already a ton of work to maintain packages in stable distributions.
- wtetzner 6y ago
  I’m confused by your comment. This is about a programming language package manager, not an OS package manager. Or was that just an example?

vlovich123 6y ago

As I said above: > Now whether or not it's a good idea to support this kind of dependency stuff can be controversial. In practice though clearly it does cause problems the larger your codebase gets as you're more likely to have some nested dependency chain that's time-consuming to upgrade so you'd rather move faster than make sure you're only running 1 version of the dependency. Consider the view that some times it can be sloppy & other times it's not & it's impossible to distinguish between the two in an automated fashion.