2 ms·
> Because you and others draw parallels to left-pad and that is very far from what is actually happening in the Rust ecosystem. Sorry, where did I mention left
by palata 2y ago
> Because you and others draw parallels to left-pad and that is very far from what is actually happening in the Rust ecosystem.
Sorry, where did I mention left-pad?
The only thing I say is: writing a project in C++, I can keep control and have a few dependencies. Doing the same thing in Rust explodes almost immediately: as soon as I add one dependency, the lock file is so big I stop giving a shit.
You can say I am wrong, but I'm just sharing a feeling.
- pdimitar 2y agoCorrect, you're sharing a feeling. And feelings don't matter in our line of work. Also I wasn't aware you should be "giving a shit" about a lock file. Nor why would that matter for anything at all. The final program works and you didn't have to reinvent complex wheels (like terminal sizing in OP). I don't see the problem. I only see wins.
- palata 2y agoWell the problem is exactly what I wrote in my original post: if you pull malware into your program as a transitive dependency, then you ship malware to your users. You should care about not shipping malware to your users, I don't know how to put it differently.
- pdimitar 2y agoWe all know the dangers, dude. It's always a ROI and other analyses: stakeholders don't care much about malware in transitive dependencies, they want feature X within timeline Y. Do I like it? No, I hate it with all my heart, but that's the reality we live in. I am not paid to just tinker with the computer; I am paid to deliver stuff, within various deadlines, and of certain quality and that's not the highest possible, otherwise I'd thoroughly use fuzzers and fiddle with property tests for months, if not years.