4 ms·
> In rust an int is an int And Rust ints can overflow. It's a tradeoff. >> Version pinning is a bad practice because it slows deployment of security updates.
by progval 5y ago
> In rust an int is an int
And Rust ints can overflow. It's a tradeoff.
>> Version pinning is a bad practice because it slows deployment of security updates.
> How is that not true for stdlibs?
Because, if without pinning, the package manager always gets the latest available version and installs it for all applications on the system once and for all. When pinning dependencies, system administrators need to wait for every single application to update its pin.
- DerArzt 5y agoDo we want to always get the latest version? The whole colors.js and faker.js thing from yesterday comes to mind as a very good reason to not want to auto-update to the latest version of a lib.
- progval 5y agoThat's why I install from curated package repositories (eg. Debian) as much as possible, and encourage users of my own software to do so as well.
- jimktrains2 5y ago> And Rust ints can overflow. There are provisions to do math that won't overflow or that can saturate. For example https://doc.rust-lang.org/std/primitive.u32.html#method.checked_sub https://doc.rust-lang.org/std/primitive.u32.html#method.chec...
- progval 5y agoSure, but it's less convenient to use.