4 ms·

Sure, there are various dependencies, but it's nothing like "cargo install crate-name". Cargo makes it so effortless to joink the dumbest dependency for the sim

by harha_ 1y ago

Sure, there are various dependencies, but it's nothing like "cargo install crate-name". Cargo makes it so effortless to joink the dumbest dependency for the simplest thing.

zaptheimpaler 1y ago
Sure, I think software that's easy to use is a good thing and Rust dependency management is 100x nicer to work with than C++.
tonyhart7 1y ago
so what's the option??? I don't think this is only cargo-rust problem since you can do it too in another language
crote 1y ago
On the other hand, C/C++ makes it attractive to reinvent the wheel, or vendor the dependency instead. Rather than a single well-tested implementation in the ecosystem for something like sha256, you end up with every application having its own slightly-different, mostly untested, and essentially unmaintained version. Applications still need the functionality. The need doesn't magically disappear when installing dependencies is a pain. If a crate has a bug, the entire ecosystem can trivially get the fixed version. If the Stackoverflow snippet a C app is vendoring has a bug, that fix is never getting in the app.
- uecker 1y ago
  That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically link to the right libraries instead of vendoring the code. Then the library can be updated once. IMHO this is the only reasonable approach.
  - simonask 1y ago
    It's trivial to see on crates.io whether a crate is unmaintained.
    - uecker 1y ago
      Maybe if it is completely unmaintained, but this is not enough to solve the problem and maybe also not really the point.
    - shwouchk 1y ago
      is it trivial to see if a third level dependency is unmaintained?
kibwen 1y ago
> Sure, there are various dependencies, but it's nothing like "cargo install crate-name". You don't install a Rust crate to use it. We have enough people in this thread trying to authoritatively talk about Rust without having any experience with it, please don't bother leaving a comment if you're just going to argue from ignorance.

by harha_ 1y ago

Sure, there are various dependencies, but it's nothing like "cargo install crate-name". Cargo makes it so effortless to joink the dumbest dependency for the simplest thing.

zaptheimpaler 1y ago

Sure, I think software that's easy to use is a good thing and Rust dependency management is 100x nicer to work with than C++.

tonyhart7 1y ago

so what's the option??? I don't think this is only cargo-rust problem since you can do it too in another language

crote 1y ago

On the other hand, C/C++ makes it attractive to reinvent the wheel, or vendor the dependency instead. Rather than a single well-tested implementation in the ecosystem for something like sha256, you end up with every application having its own slightly-different, mostly untested, and essentially unmaintained version. Applications still need the functionality. The need doesn't magically disappear when installing dependencies is a pain. If a crate has a bug, the entire ecosystem can trivially get the fixed version. If the Stackoverflow snippet a C app is vendoring has a bug, that fix is never getting in the app.

uecker 1y ago
That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically link to the right libraries instead of vendoring the code. Then the library can be updated once. IMHO this is the only reasonable approach.
- simonask 1y ago
  It's trivial to see on crates.io whether a crate is unmaintained.
  - uecker 1y ago
    Maybe if it is completely unmaintained, but this is not enough to solve the problem and maybe also not really the point.
  - shwouchk 1y ago
    is it trivial to see if a third level dependency is unmaintained?

kibwen 1y ago

> Sure, there are various dependencies, but it's nothing like "cargo install crate-name". You don't install a Rust crate to use it. We have enough people in this thread trying to authoritatively talk about Rust without having any experience with it, please don't bother leaving a comment if you're just going to argue from ignorance.