4 ms·

I think the size of the stdlib is a bit misplaced. If you look at many of the complaints, many of which I agree with, the real issue isn't whether something is

I think the size of the stdlib is a bit misplaced. If you look at many of the complaints, many of which I agree with, the real issue isn't whether something is part of the language distribution itself or provided externally. The problem is bloat in the dependency tree. Nobody wants to individually vet a thousand plus library authors and enterprise/government or just anyone who cares a lot about supply chain security is not likely to consider "number of downloads" on crates.io a reliable proxy of trustworthiness. Large collections of libraries that can often be pulled in as a single dependency, like boost, apache-commons, or all of the C libraries provided for free by a GNU system, are a nice middle ground. They're trusted, large enterprises will let you use them, you don't need to separately download every single library, but the core language maintainers don't need to maintain these collections themselves and they don't have to be subject to hard backwards compatibility guarantees provided by a built-in std. But, of course, that also means you can't ask the core language maintainers to create this for you. These are community efforts. Also, I don't believe any of them existed within 11 years of the language first being released. Curated, dependable library collections that become ubiquitous as part of a language ecosystem take time to come about.

fivea 5y ago
> The problem is bloat in the dependency tree. Nobody wants to individually vet a thousand plus library authors and enterprise/government or just anyone who cares a lot about supply chain security is not likely to consider "number of downloads" on crates.io a reliable proxy of trustworthiness. That problem does not magically go away with a bloated stdlib. Take Java, for example, with it's colossal list of standard modules, with which Rust cannot possibly match or even rival. Yet, any reasonably sized Java project still ends up dragging in dozens of third-party modules to the point that not using a dependency management system is unheard of.
hedora 5y ago
Funny, boost and libcommons are my default examples of harmful dependency bloat. The main problem with both is that they have some narrow functionality I actually want, but they also contain millions of lines of brain damaged garbage. (Which, at least for boost, is by design, since it’s a proving ground for stuff destined for the C++ standard library.) The second they’re available, junior devs find the worst corners of them, and build in hard dependencies while no one’s looking. I prefer the curated distribution approach that Debian takes: Fine grained dependencies are widely available, but gated behind some sort of reputation-based quality assurance process.

fivea 5y ago

> The problem is bloat in the dependency tree. Nobody wants to individually vet a thousand plus library authors and enterprise/government or just anyone who cares a lot about supply chain security is not likely to consider "number of downloads" on crates.io a reliable proxy of trustworthiness. That problem does not magically go away with a bloated stdlib. Take Java, for example, with it's colossal list of standard modules, with which Rust cannot possibly match or even rival. Yet, any reasonably sized Java project still ends up dragging in dozens of third-party modules to the point that not using a dependency management system is unheard of.

hedora 5y ago

Funny, boost and libcommons are my default examples of harmful dependency bloat. The main problem with both is that they have some narrow functionality I actually want, but they also contain millions of lines of brain damaged garbage. (Which, at least for boost, is by design, since it’s a proving ground for stuff destined for the C++ standard library.) The second they’re available, junior devs find the worst corners of them, and build in hard dependencies while no one’s looking. I prefer the curated distribution approach that Debian takes: Fine grained dependencies are widely available, but gated behind some sort of reputation-based quality assurance process.