4 ms·

Even if we put away conversation about OS-provided vs. direct-from-developer libraries, why would one want centralized repositories like crates.io, instead of d

Even if we put away conversation about OS-provided vs. direct-from-developer libraries, why would one want centralized repositories like crates.io, instead of decentralized CVSs like Git, and just link Git URL like dependencies? Seems to me that such centralized repositories have all common disadvantages of centralized solutions, but without their advantages.

zdimension 3y ago
Using cargo (the build tool), you can add dependencies using Git URLs. Referencing crates.io is just "the usual way" to add dependencies. Git repositories can disappear (becoming private, author changes username, etc.), crates.io is more resilient than the average OSS project repo. Most people use one of a handful of Git hosts anyway (GitHub, GitLab, ...) so Git dependencies are still like a huge centralized repo.
pornel 3y ago
Cargo already supports using git repos as package sources, but it's painful to use due to slowness of the git protocol. HTTP registry updates are nearly instant in comparison. If git was the only option, most people would probably just use GitHub, which is merely changing one big host for another. When it's actually decentralized, when developers use their own git URLs on their own domain, suddenly you have to worry about things like the domains expiring. You have to worry about security practices of every single host. crates.io is a big target, but they know it and act accordingly. crates.io doesn't allow deleting of packages, but an arbitrary git URL can disappear causing a "left-pad" incident. Some of these problems could be solved with another protocol better suited for decentralization (where the data is immutable and content addressable, and identities are private keys rather than domains), but that's way more complex than "just use git".

4 ms·

Even if we put away conversation about OS-provided vs. direct-from-developer libraries, why would one want centralized repositories like crates.io, instead of d

by zajio1am 3y ago

zdimension 3y ago
Using cargo (the build tool), you can add dependencies using Git URLs. Referencing crates.io is just "the usual way" to add dependencies. Git repositories can disappear (becoming private, author changes username, etc.), crates.io is more resilient than the average OSS project repo. Most people use one of a handful of Git hosts anyway (GitHub, GitLab, ...) so Git dependencies are still like a huge centralized repo.
pornel 3y ago
Cargo already supports using git repos as package sources, but it's painful to use due to slowness of the git protocol. HTTP registry updates are nearly instant in comparison. If git was the only option, most people would probably just use GitHub, which is merely changing one big host for another. When it's actually decentralized, when developers use their own git URLs on their own domain, suddenly you have to worry about things like the domains expiring. You have to worry about security practices of every single host. crates.io is a big target, but they know it and act accordingly. crates.io doesn't allow deleting of packages, but an arbitrary git URL can disappear causing a "left-pad" incident. Some of these problems could be solved with another protocol better suited for decentralization (where the data is immutable and content addressable, and identities are private keys rather than domains), but that's way more complex than "just use git".