3 ms·
> simplified dependency tree. Which doesn't necessary help. Like eight "simple/small" dependencies from the same author might be a better choice then two huge
by dathinab 5y ago
> simplified dependency tree.
Which doesn't necessary help.
Like eight "simple/small" dependencies from the same author might be a better choice then two huge dependencies from two different authors.
What matters is not the number of dependencies but the amount of code/complexity you depend one and the number of sources/authors/author-groups.
Also in this case you probably would have keep this dependency in you simplified dependency tree...
- shukantpal 5y agoYes, but most dependencies are generally from different authors so the chance of malicious actors goes up with dependencies.
- khimru 5y agoJust look here: https://github.com/dtolnay?tab=repositories https://github.com/dtolnay?tab=repositories David Tolnay have 89 repos and if you are doing any Rust work at all the chances are high that you would have dozen of them in your dependency chain. Would merging of them help security? I don't think so: most of these crates are useful but they are quite diverse and it doesn't make much sense to put them into one package.
- dathinab 5y agoKinda, but also depends on the language a lot. E.g. in rust it's not uncommon to sometimes split libraries, e.g. -derive libraries (proc macros/derives), -sys (C-bindings without any logic/abstraction, most times auto-generated), and internal components. So counting just the number of "dependencies" can easily get you results, which are way off. Like actix-web has over 10 internal dependencies. (through I should note that they are in the same physical package/uploaded archive, i.e. they are treated as separate packages by rust, but are a single upload, have a single version number etc.).