5 ms·

As you say, a typical Rust program can easily depend on hundreds of crates that nobody really checks. That's a security issue. The whole point of a distro is t

by palata 2y ago

As you say, a typical Rust program can easily depend on hundreds of crates that nobody really checks. That's a security issue. The whole point of a distro is that someone distributes them, so you can choose which distro you want to trust. What I don't like about Rust and Go is that they enforce their preference. I am fine if you want to link everything statically. I just don't want you to force me.

akira2501 2y ago
You're not forced to with Go. CGO exists and requires dynamic linking.
- deleted 2y ago
  [deleted]
newZWhoDis 2y ago
More software should “enforce” their preferences, many decisions are objectively superior and this “anything goes” attitude has done nothing but hurt OSS/Linux adoption. Everything about the shared lib model is stupid, and has contributed to poor Linux market share to date.
- palata 2y ago
  I couldn't disagree more. > Everything about the shared lib model is stupid I don't think we can discuss if that's you're stance. But also I don't think you understand the shared lib model if you think like that.
- lmz 2y ago
  Dynamic linking seems to work fine for Windows or OSX. Maybe it's open source + dynamic linking that's the problem.
  - palata 2y ago
    Honestly a problem is that most developers just don't understand how it works. Docker / static linking solves a lack of understanding, mostly. That's why they are popular.
kibwen 2y ago
> I just don't want you to force me. Rust supports dynamic linking, and has since well before 1.0.
- palata 2y ago
  In practice, it feels like everybody assumes that Rust is installed through Rustup and dependencies are statically linked from cargo. I have tried going the dynamic linking way, it's painful when it's not impossible.
  - School-Cotton 2y ago
    Regardless of what "everybody assumes", you can in fact build rust binaries without using rustup or cargo. Distros do this. Yes, it's more painful for end users than just typing `cargo build`, but that's irrelevant to distro maintainers.
    - palata 2y ago
      Some software (e.g. IDEs) will call `rustup` for some reason (yep, it happened to me and I therefore couldn't use that software). > Yes, it's more painful for end users than just typing `cargo build` Cargo is fine, I don't mind installing cargo. I just don't want my packages to be handled by my package manager. I don't want every project to ship their own custom package manager like rustup.
- glandium 2y ago
  That's kind of a disingenuous take. Rust supports producing dynamically loadable libraries. It doesn't support dynamically linking arbitrary dependencies, which is what most people would understand from "Rust supports dynamic linking" in a discussion about static linking.
  - kibwen 2y ago
    > It doesn't support dynamically linking arbitrary dependencies I don't understand why one would think this. You make it sound as though Rust only supports dynamic linking for glibc, but that's certainly not true.

by palata 2y ago

akira2501 2y ago

You're not forced to with Go. CGO exists and requires dynamic linking.

deleted 2y ago
[deleted]

newZWhoDis 2y ago

More software should “enforce” their preferences, many decisions are objectively superior and this “anything goes” attitude has done nothing but hurt OSS/Linux adoption. Everything about the shared lib model is stupid, and has contributed to poor Linux market share to date.

palata 2y ago
I couldn't disagree more. > Everything about the shared lib model is stupid I don't think we can discuss if that's you're stance. But also I don't think you understand the shared lib model if you think like that.
lmz 2y ago
Dynamic linking seems to work fine for Windows or OSX. Maybe it's open source + dynamic linking that's the problem.
- palata 2y ago
  Honestly a problem is that most developers just don't understand how it works. Docker / static linking solves a lack of understanding, mostly. That's why they are popular.

kibwen 2y ago

> I just don't want you to force me. Rust supports dynamic linking, and has since well before 1.0.

palata 2y ago
In practice, it feels like everybody assumes that Rust is installed through Rustup and dependencies are statically linked from cargo. I have tried going the dynamic linking way, it's painful when it's not impossible.
- School-Cotton 2y ago
  Regardless of what "everybody assumes", you can in fact build rust binaries without using rustup or cargo. Distros do this. Yes, it's more painful for end users than just typing `cargo build`, but that's irrelevant to distro maintainers.
  - palata 2y ago
    Some software (e.g. IDEs) will call `rustup` for some reason (yep, it happened to me and I therefore couldn't use that software). > Yes, it's more painful for end users than just typing `cargo build` Cargo is fine, I don't mind installing cargo. I just don't want my packages to be handled by my package manager. I don't want every project to ship their own custom package manager like rustup.
glandium 2y ago
That's kind of a disingenuous take. Rust supports producing dynamically loadable libraries. It doesn't support dynamically linking arbitrary dependencies, which is what most people would understand from "Rust supports dynamic linking" in a discussion about static linking.
- kibwen 2y ago
  > It doesn't support dynamically linking arbitrary dependencies I don't understand why one would think this. You make it sound as though Rust only supports dynamic linking for glibc, but that's certainly not true.