3 ms·
Zero-external-dependency Go apps are far more feasible than Rust or Node, simply because of the size and quality of the standard library.
by jen20 1y ago
Zero-external-dependency Go apps are far more feasible than Rust or Node, simply because of the size and quality of the standard library.
- ncruces 1y agoJust the other day someone argued with me that it was reasonable for Limbo (the SQLite Rust rewrite) to have 3135 dependencies (of those, 1313 Rust dependencies). https://github.com/tursodatabase/turso/network/dependencies https://github.com/tursodatabase/turso/network/dependencies
- whstl 1y agoThis is incredible. At this rate, there's a non-zero chance that one of the transitive dependencies is SQLite itself.
- wolvesechoes 1y agoBut it will be safe SQlite, called from Rust.
- Meneth 1y ago3 different types of sqlite, 14 different versions total: https://github.com/tursodatabase/turso/network/dependencies?q=sqlite https://github.com/tursodatabase/turso/network/dependencies?...
- aw1621107 1y agoLooks like they're all pulled in as dev dependencies. libsqlite3-sys gets pulled in by rusqlite, which is used by core_tester, limbo_sim, write-throughput-sqlite, and as a dev_dependency for turso_core.
- Ygg2 1y agoYeah. You have dev dependencies in there, those alone will increase number of dependencies by ~500, without ending up in the final product. Those numbers are way off their actual number.
- what 1y ago500 dev dependencies doesn’t seem reasonable either…
- zwnow 1y agoEven 50 seems unreasonable...
- ncruces 1y agoRight. Allowing 500 strangers to push code to our CI infra, or developer laptops, with approximately zero review, sounds similarly ill advised. That JLR got their factories hacked, rather than customer cars, is less bad for sure. But it's still pretty bad. Also, before arguing that code generators should get a pass as they don't “end up in the final product”, you really should read “Reflections on trusting trust” by Ken Thompson.
- Ygg2 1y ago> Right. Allowing 500 strangers to push code to our CI infra That's bullshit, pure and simple. If you pull in a deeply nested dependency like icu_normalizer it has 30 dependencies, OMGHAXOZRS. I'm doing this, so I don't have to spend a day going through the library. Except of the 30 depedencies crates, there are 10 from ICUX repository, and then you have almost standard dependencies like proc-macro/syn/quote crates from dtolnay, `zerofrom` from Google. `smallvec` from the Servo project, and yoke from... checks notes... from ICUX. The only few remaining crates here are `write16`, `utf8_iter` and `utf16_iter` that are written from hsivonen, who is also a ICUX contributor. So even for 30 dependencies, you actually depend on proc-macro/syn/quote which are foundational crates. Few crates from Google, few crates from Servo, and three crates written by another ICUX contributor. We started with 30 dependencies and ended up with 3 strangers
- ricardobeat 1y agoEven more wild considering that SQLite prides itself on having zero dependencies. Sounds like a doomed project.