4 ms·

> The other reason I wanted to make a DNS client is that I knew I could simplify every step using some great Rust crates This is one of the reasons I rather li

> The other reason I wanted to make a DNS client is that I knew I could simplify every step using some great Rust crates This is one of the reasons I rather like rust and it's ecosystem: you can delegate "boring" functionality (aka the stuff you need, but aren't interested in writing) to the ecosystem and just focus on the stuff you want to. Other languages also have a similarly rich ecosystem (python in particular). But compared to python, I find that rust is slightly better; 2 reasons come to mind: * Docs in rust seem to be slightly better. I think this is partly due to the generally high quality of docs.rs, so crate authors seem to have settled on the idea that some minimal baseline docs are expected. * Error handling in rust feels better. In the python world, I would see None returned some library functions that didn't really document this possibility, yielding an uncomfortable number of runtime TypeErrors or AttributeErrors due to an unexpected NoneType

vlovich123 5y ago
Package management is also drastically simplified because cargo is standard vs you have to basically do everything from scratch in Python land
- eminence32 5y ago
  As a consumer, pip is pretty good though
  - vlovich123 5y ago
    Pip isn’t suitable for development. Having a global shared package installation doesn’t work if working on separate codebases. It also doesn’t work because you get implicit dev dependencies and then how do you share those when you want to collaborate? Requirements.txt is a laugh for several reasons. Pip-compile and then installing that into a virtualenv is a neat solution that I found. Not sure if there’s anything meaningfully better yet.
- SnowHill9902 5y ago
  Is cargo more vulnerable to supply chain attacks than downloading a C++ lib and compiling?
  - hamandcheese 5y ago
    I’m not a big Rust user, but my understanding is that Cargo.lock contains checksums. So the answer to your question would be no. Downloading a C++ lib and using Cargo are both effectively trust on first use.
  - eminence32 5y ago
    rust might be more vulnerable in practice because it's so easy to add 3rd-party code (and update 3rd-party code).
    - carlmr 5y ago
      Exactly. In C++ everybody just writes their own libraries which enable other kinds of bugs and vulnerabilities.
deepsun 5y ago
Java ecosystem is a quintessence of delegating boring stuff. But without wild westness of NPM, libraries (aka crates) feel more "serious".
- jeroenhd 5y ago
  In my experience the Java world tries to look more serious with all dependencies having fancy corporate names, but the end result is exactly the same. Log4j proved to the world that Java has as much of a dependency tree hell problem as any other programming language. What I find annoying about Java is that very major dependencies are either slow-moving, making upgrading to a new Java version quite a challenge, or require constant rewrites with new releases. I've come to expect that upgrading dependencies usually means "the code works except for these methods being a bit different" but in Java libraries the entire API can change on a whim. The only thing I find "serious" about it is that everyone seems to run ancient versions of Java because their dependencies are impossible to upgrade. It's no wonder that Java 8 seems to be as popular as ever despite the two LTS releases since.

vlovich123 5y ago

Package management is also drastically simplified because cargo is standard vs you have to basically do everything from scratch in Python land

eminence32 5y ago
As a consumer, pip is pretty good though
- vlovich123 5y ago
  Pip isn’t suitable for development. Having a global shared package installation doesn’t work if working on separate codebases. It also doesn’t work because you get implicit dev dependencies and then how do you share those when you want to collaborate? Requirements.txt is a laugh for several reasons. Pip-compile and then installing that into a virtualenv is a neat solution that I found. Not sure if there’s anything meaningfully better yet.
SnowHill9902 5y ago
Is cargo more vulnerable to supply chain attacks than downloading a C++ lib and compiling?
- hamandcheese 5y ago
  I’m not a big Rust user, but my understanding is that Cargo.lock contains checksums. So the answer to your question would be no. Downloading a C++ lib and using Cargo are both effectively trust on first use.
- eminence32 5y ago
  rust might be more vulnerable in practice because it's so easy to add 3rd-party code (and update 3rd-party code).
  - carlmr 5y ago
    Exactly. In C++ everybody just writes their own libraries which enable other kinds of bugs and vulnerabilities.

deepsun 5y ago

Java ecosystem is a quintessence of delegating boring stuff. But without wild westness of NPM, libraries (aka crates) feel more "serious".

jeroenhd 5y ago
In my experience the Java world tries to look more serious with all dependencies having fancy corporate names, but the end result is exactly the same. Log4j proved to the world that Java has as much of a dependency tree hell problem as any other programming language. What I find annoying about Java is that very major dependencies are either slow-moving, making upgrading to a new Java version quite a challenge, or require constant rewrites with new releases. I've come to expect that upgrading dependencies usually means "the code works except for these methods being a bit different" but in Java libraries the entire API can change on a whim. The only thing I find "serious" about it is that everyone seems to run ancient versions of Java because their dependencies are impossible to upgrade. It's no wonder that Java 8 seems to be as popular as ever despite the two LTS releases since.