3 ms·
I thought I was alone thinking like this. Honestly, when I want to compile a Rust project and see all these dependencies getting pulled in to get compiled alon
by stefanos82 1y ago
I thought I was alone thinking like this.
Honestly, when I want to compile a Rust project and see all these dependencies getting pulled in to get compiled along with the project, it gives me goosebumps, because I don't know whether these crates are safe and secured or not...
- vsgherzi 1y agoYeah, I think in some sense it definitely looks worse than it is since a single crate like Tokio is spread among 20-30 crates. However even accounting for that there's still just alot of raw code...
- weird_trousers 1y agoYou're definitely not alone. This situation is not new, and it isn't acceptable either. The concept of `features` when using a crate is kinda cool as "you only download / compile what you use" *but* most of the crates are very badly designed, and also developers do not tend to reinvent a very tiny wheel when they can, but heavily depend of possibly dangerous crates to just serialize or deserialize a very simple data structure... It's very annoying, as this increases the compilation time and introduces possible unsafe behavior in larger crates.
- wofo 1y agoSome people _do_ care about this (e.g. the proponents of this new RFC: https://github.com/rust-lang/rfcs/pull/3810 https://github.com/rust-lang/rfcs/pull/3810). However, for some reason (culture, I guess?) there isn't much momentum yet to change the status quo.