12 ms·

isn't what you're arguing for essentially to make Rustls (or at least its API) part of a Rust standard library, so that everyone's forced (or very highly encour

by querez 5y ago

isn't what you're arguing for essentially to make Rustls (or at least its API) part of a Rust standard library, so that everyone's forced (or very highly encouraged) to use it instead of alternatives?

est31 5y ago
Not suggesting it should be done, but note that Go does r̵i̵g̵h̵t̵ ̵t̵h̵i̵s̵ exactly this. They also have world class crypto people on the language team.
- richardwhiuk 5y ago
  In what sense does Go do this right?
  - est31 5y ago
    It does right this not, this right. It's accessible to every go program: https://golang.org/pkg/crypto/tls/ https://golang.org/pkg/crypto/tls/
    - pitaj 5y ago
      I've never heard someone use right this, is that similar to exactly this or just this?
      - richardwhiuk 5y ago
        Yeah, I'd expect that to be phrased as "does this" - the right seems utterly superfluous at best, and very misleading. "Right this minute" is a common phrase, but "does right this" isn't (at least in UK English).
        est31 5y ago
        Hmm seems you are right. I guess it's a german-ism that slipped into my english. The english analog to "macht genau das" is either "does exactly that" or "does just that". The literal translation I used "does right this" seems to have no use. So my bad, I'm sorry.
        richardwhiuk 5y ago
        No problem :)
    - varajelle 5y ago
      Http and https is accessible to every Rust program as well. It just has to be opt-in in Cargo.toml
- hctaw 5y ago
  Go has to do this because they include https in the standard library. Rust defers that task to the ecosystem, so it doesn't have the same requirements.
  - hda2 5y ago
    Seeing that HTTP/S is now just as fundamental as tcp and udp, perhaps Rust should also consider doing the same? Sure, leave the more complex HTTP apis to the ecosystem, but Rust should at least have some sort of basic HTTP support. I don't think you can get away with not treating HTTP as a first class citizen anymore. IMO, Go got this right.
    - varajelle 5y ago
      Rust has HTTP and HTTPS support. You just have to enable it in your Cargo.toml. The ecosystem is part of rust.
      - hda2 5y ago
        To you, perhaps, but I wholeheartedly disagree. Rust will have support only when it is included in the standard library.
    - hctaw 5y ago
      If you spend all day writing web servers and clients it might seem fundamental. Most of my code doesn't touch the network so I don't mind if I need the ecosystem to do it - I do that in C and C++ too. I think people are fairly apprehensive towards a bigger std because firstly, dependency management is almost trivial (C++ needs the kitchen sink in std because dependencies don't exist to the language, for example) so it's not that big of a deal, and secondly because a bigger std means a bigger commitment to APIs and maintenance by a relatively small group of maintainers for all eternity. At the level of the stack where it makes sense to use rust, it doesn't make sense to put HTTP in std. At least not like Go.
      - hda2 5y ago
- deleted 5y ago
  [deleted]
e12e 5y ago
I think that if tcp[1] is in the stdlib, tls probably should be too. Maybe even ssh. I get there was a time when "listen to the network" meant plain text networking - but today, for a large subset of applications and libraries, not supporting tls is a bug. [1] https://doc.rust-lang.org/std/net/struct.TcpListener.html https://doc.rust-lang.org/std/net/struct.TcpListener.html
- ChrisSD 5y ago
  Implementing crypto is much much harder than simply providing abstractions over the OS' TCP/UDP APIs. Far better to let the experts do it.
  - e12e 5y ago
    That's not really an argument against having it in stdlib, though?
    - ChrisSD 5y ago
      It's much simpler to develop complex libraries outside of the stdlib. And given Rust's strong stability guarantees, it can't stabilize any APIs until they're finalized anyway. So development of new APIs often happens outside the stdlib and then if a third party library proves itself and can commit to a completely stable API then it might be uplifted into the stdlib, so long as there's a very strong case to do so. I should also add that most applications won't even be using the TCP/UDP primitives directly. They'll likely be using a third party library. Rust's stdlib is intentionally minimal and lacking a lot of higher level features that are practically necessary for many applications.
- baby 5y ago
  Tls is part of Golang’s stdlib

by querez 5y ago

est31 5y ago

Not suggesting it should be done, but note that Go does r̵i̵g̵h̵t̵ ̵t̵h̵i̵s̵ exactly this. They also have world class crypto people on the language team.

richardwhiuk 5y ago
In what sense does Go do this right?
- est31 5y ago
  It does right this not, this right. It's accessible to every go program: https://golang.org/pkg/crypto/tls/ https://golang.org/pkg/crypto/tls/
  - pitaj 5y ago
    I've never heard someone use right this, is that similar to exactly this or just this?
    - richardwhiuk 5y ago
      Yeah, I'd expect that to be phrased as "does this" - the right seems utterly superfluous at best, and very misleading. "Right this minute" is a common phrase, but "does right this" isn't (at least in UK English).
      - est31 5y ago
        Hmm seems you are right. I guess it's a german-ism that slipped into my english. The english analog to "macht genau das" is either "does exactly that" or "does just that". The literal translation I used "does right this" seems to have no use. So my bad, I'm sorry.
        richardwhiuk 5y ago
        No problem :)
  - varajelle 5y ago
    Http and https is accessible to every Rust program as well. It just has to be opt-in in Cargo.toml
hctaw 5y ago
Go has to do this because they include https in the standard library. Rust defers that task to the ecosystem, so it doesn't have the same requirements.
- hda2 5y ago
  Seeing that HTTP/S is now just as fundamental as tcp and udp, perhaps Rust should also consider doing the same? Sure, leave the more complex HTTP apis to the ecosystem, but Rust should at least have some sort of basic HTTP support. I don't think you can get away with not treating HTTP as a first class citizen anymore. IMO, Go got this right.
  - varajelle 5y ago
    Rust has HTTP and HTTPS support. You just have to enable it in your Cargo.toml. The ecosystem is part of rust.
    - hda2 5y ago
      To you, perhaps, but I wholeheartedly disagree. Rust will have support only when it is included in the standard library.
  - hctaw 5y ago
    If you spend all day writing web servers and clients it might seem fundamental. Most of my code doesn't touch the network so I don't mind if I need the ecosystem to do it - I do that in C and C++ too. I think people are fairly apprehensive towards a bigger std because firstly, dependency management is almost trivial (C++ needs the kitchen sink in std because dependencies don't exist to the language, for example) so it's not that big of a deal, and secondly because a bigger std means a bigger commitment to APIs and maintenance by a relatively small group of maintainers for all eternity. At the level of the stack where it makes sense to use rust, it doesn't make sense to put HTTP in std. At least not like Go.
    - hda2 5y ago
deleted 5y ago
[deleted]

e12e 5y ago

I think that if tcp[1] is in the stdlib, tls probably should be too. Maybe even ssh. I get there was a time when "listen to the network" meant plain text networking - but today, for a large subset of applications and libraries, not supporting tls is a bug. [1] https://doc.rust-lang.org/std/net/struct.TcpListener.html https://doc.rust-lang.org/std/net/struct.TcpListener.html

ChrisSD 5y ago
Implementing crypto is much much harder than simply providing abstractions over the OS' TCP/UDP APIs. Far better to let the experts do it.
- e12e 5y ago
  That's not really an argument against having it in stdlib, though?
  - ChrisSD 5y ago
    It's much simpler to develop complex libraries outside of the stdlib. And given Rust's strong stability guarantees, it can't stabilize any APIs until they're finalized anyway. So development of new APIs often happens outside the stdlib and then if a third party library proves itself and can commit to a completely stable API then it might be uplifted into the stdlib, so long as there's a very strong case to do so. I should also add that most applications won't even be using the TCP/UDP primitives directly. They'll likely be using a third party library. Rust's stdlib is intentionally minimal and lacking a lot of higher level features that are practically necessary for many applications.
baby 5y ago
Tls is part of Golang’s stdlib