4 ms·
I have the opposite problem with rust dependency management, its too easy so you get deep widely branching dependency trees by differing authors with differing
by galangalalgol 5y ago
I have the opposite problem with rust dependency management, its too easy so you get deep widely branching dependency trees by differing authors with differing licenses. From a corporate use perspective this is a legal nightmare. From a security standpoint, this is a trust nightmare.
- benreesman 5y agoIn fairness, you have those problems no matter how you include other people's code. At least Cargo as far as I'm aware uses a SAT-solver to deliver you a working dep graph unlike `pip` or `npm` or any of that nonesense. (as long as I remember correctly that Carl Lerche wrote that part. Sidebar: wicked smart guy).
- galangalalgol 5y agoYou do, but clunky dependency management meant fewer less granular dependencies.
- Keyframe 5y agoFor licenses there's cargo-deny https://github.com/EmbarkStudios/cargo-deny https://github.com/EmbarkStudios/cargo-deny On the security standpoint and a wide net of crates.. that's a problem, same as with npm/yarn/pip/whatever and I agree on that. That one bugs me as well. Difficult to audit.
- galangalalgol 5y agoCargo-deny is accurate, but it accepts no legal or financial risk if it was in some case wrong and you infected a codebase with gplv3, and thus corporate lawyers everywhere ignore it. Edit: this post keeps getting up and down voted. I suspects it has to do with the phrase infected by gplv3. I like the license fine, but being realistic many businesses treat it like radioactive waste, so that has to be a consideration