3 ms·
Yes. One glance at Log4j fiasco shows no one really understood all of the code.
by Ygg2 5y ago
Yes. One glance at Log4j fiasco shows no one really understood all of the code.
- GuB-42 5y agoLog4j is not a standard library, it is just very popular, and it proves the original concern. It is treated as standard but it is not, and package muddle the waters even more. Remember leftPad. The lack of a stable ABI is also a problem. For example, on my Linux distro, if a library has a bug, I just update the library and all software using it are fixed. No need to recompile everything. So, essentially, the cargo system makes it easy to import weak code and hard to fix it later. I am not saying that cargo is terrible, but it is a problem with rust that is not to be dismissed.
- Ygg2 5y agoIt still doesn't negate my point. You need to rely on other people's code. Whether it std lib or not. Left pad is because of: A) ease of modularization B) problems with tree shaking C) people want small easily understandable library Which tbh works more often than not. ---- Stable ABI is a curse as much as blessing. Once you have stable ABI, you will never want to break it. Even if breaking ABI would be beneficial long term. See https://cor3ntin.github.io/posts/abi/ https://cor3ntin.github.io/posts/abi/ And if you desire Stable ABI there is option of exposing C API in Rust. ---- > So, essentially, the cargo system makes it easy to import weak code and hard to fix it later. Hard for who? Cargo can easily fork a package and recompile it. It makes it harder for distros. But you can ship static linked dependencies, easily.