3 ms·
Rust has dependency hell and supply chain attacks like with npm.
by hoppp 1y ago
Rust has dependency hell and supply chain attacks like with npm.
- steveklabnik 1y agoYou control the dependencies you put in Cargo.toml.
- hoppp 1y agoWhat about the dependencies of your dependencies? I don't put too many things in Cargo.toml and it still pulls like a hundred things
- BrouteMinou 1y agoYour system is going to be owned, but at least, it's going to be "memory safely" owned! P. S. I you don't account all the unsafe sections scattered everywhere in all those dependencies.
- ghosty141 1y agoThen don't? In C you would just implement everything yourself, so go do that in Rust if you don't want dependencies. In C I've seen more half-baked json implementations than I can count on my fingers because using dependencies is too cumbersome in that ecosystem and people just write it themselves but most of the time with more bugs.
- rendaw 1y agoDirect and transitive dependencies are locked and hashed.
- steveklabnik 1y agoIf you care about not having any dependencies, then choosing dependencies that themselves don't have many dependencies should be going into the ones that you choose.
- mamcx 1y agoBut is optional. For this kind of project, is logical to adopt something like the tiger battle ethos and own all the code and have no external deps (or vendor them). Even do your own std if wanna. Is hard work? But is not that different from what you see in certain C projects that neither use external deps
- bsder 1y agoTigerbeetle. Your autocorrect really mangled that one ...
- krior 1y agoThe lack of dependency hell is a bit of an illusion when it comes to C. What other languages solve via library most C projects will reimplement themselves, which of course increases the chance for bugs.
- jeroenhd 1y agoC has the same problem, but it lacks a common package manager like other languages do. Just because you need to clone git submodules or run package manager commands (hope you're on a supported OS version!) doesn't mean C doesn't have package manager issues. C projects avoiding dependencies entirely just end up reimplementing work. You can do that in any language.