5 ms·

Battery packs: Let's talk about crates, baby

54 points by MeetingsBrowser 3mo ago

two_handfuls 3mo ago
For those struggling for context like me: this is about the Rust programming language.
- deleted 3mo ago
  [deleted]
deleted 3mo ago
[deleted]
wseqyrku 3mo ago
Off we go comparing battery packs. Seriously though, I wish the dual futures, streams types to be consolidated first than building anything on top of the situation.
- eptcyka 3mo ago
  Futures would be less of a problem if async was implemented as effect handling instead of coloring functions - I am truly miffed about e.g. not being to use `or_insert_with` with a fallible async function. That and build sandboxing are my 2 pie in the sky dreams for a rust edition far, far away.
  - wseqyrku 3mo ago
    > if async was implemented as effect handling By any chance, was there a proposal for that I could read?
yjftsjthsd-h 3mo ago
> Battery packs are meant to address one of the most common things I hear from new Rust adopters. Everyone loves the wealth of high-quality crates available on crates.io. And everyone hates having to spend a bunch of time researching and comparing alternatives. > [...] > One of the key ideas from battery packs is that anybody can publish one. So now we get to research and compare alternative battery packs? I guess it could help if there's fewer of them, but I don't see why that would be.
- zem 3mo ago
  at the very least you could follow some trusted entity's recommendation for a bunch of crates at once. e.g. if the author of some large rust project like bevy published a battery pack I would pay attention because they have had to solve the problem of picking out several crates and seeing that they all work well together.
ho_lee_phuk 3mo ago
Go ecosystems seems to choose quality over quantity (fewer higher-quality libraries) over Rust. What seems to be causing this?
- olalonde 3mo ago
  I'd say ease of package management. You can see this with Python too.
  - inigyou 3mo ago
    Package management is easier in Go than almost any other ecosystem, including Rust, Python and Javascript. And Go projects may have tens of package dependencies. Yet it's closer to a C++ project which has single-digit dependencies than a Javascript project which has tens of thousands.
    - olalonde 3mo ago
      Interesting. When I learned Go a while ago, it didn't have a package manager. You just pulled down master branches directly into your global GOPATH. So pulling in a dependency was a big decision and people naturally favored "batteries included" libraries. That probably still permeates the culture today.
      - inigyou 3mo ago
        That is the package manager. The package has a URL. You import the URL and you're done.
        olalonde 3mo ago
        Back then there was no versioning. When you imported a URL, you had to hope that all your projects and transient dependencies happened to be compatible with whatever commit was currently sitting on the master branch. Because one update could silently break an unrelated project on your machine, adding a dependency was a bigger decision. That naturally led the ecosystem to favor fewer, larger libraries. PS: it looks like this issue was addressed in 2019 with the introduction of Go Modules.
rickdeckard 3mo ago
The hobbyist device maker in me took waaay to long to be certain that this is NOT about physical batteries... (was already confident, then there's suddenly a screenshot mentioning display components)
- RunSet 3mo ago
  Reminds me of how calling wine prefixes "bottles" makes things easier to someone.
  - tomashubelbauer 3mo ago
    Homebrew is also great in this regard
    - bennettnate5 3mo ago
      Yeah, I definitely think "pallets" would make more sense in this context.
- cursuve 3mo ago
  Ha- same here! I was very excited to see a curated list of battery configurations/cells/wiring diagrams!
Levitating 3mo ago
In my opinion this will just worsen the ecosystem. Many Rust crates are already bloated with dependencies.
assbuttbuttass 3mo ago
Sounds like a great way to get dozens of dependencies before you even write a line of code
- functionmouse 3mo ago
  It's about boosting attack surface. Trust the plan :)
tialaramex 3mo ago
I hope one day to coincidentally have an earworm which works as sub-headings for something I want to write about.
cold_pizz4 3mo ago
Everybody agrees that Rust's ecosystem is too fragmented, but I don't think that the solution proposed here will solve anything. The most promising project to solve this problem is https://github.com/rust-stdx/stdx https://github.com/rust-stdx/stdx which is (more or less) re-creating Go's standard library in Rust.
- jvanderbot 3mo ago
  You're advocating for one solution that has two problems: * It is precisely what TFA goes in for: a one-stop shop (somewhat application dependent) * It is antithetical to the "embarassment of riches" approach that Rust tried for when they delegated almost all functionality to crates - the ecosystem has proven fruitful Oh and a third: https://xkcd.com/927/ https://xkcd.com/927/ It seems to me that advocacy, writing good applications, or human-readable guides will do more for convergence on crate bundles than a more technical solution. I reach for the crates I know, not yet-another-framework.
- chrismorgan 3mo ago
  The guy that is making stdx has been doing various shady stuff in his books and code which have resulted in all his stuff being banned on /r/rust. In stdx, he’s been forking good code, violating licenses, completely rewriting stuff with LLMs (including cryptography code, and definitely introducing bugs in the process)… it’s not a good approach.
efaref 3mo ago
I guess the name is intending to evoke the "batteries included" metaphor, but it seems pretty terrible to me. If we're sticking with the crates/cargo metaphor, surely this should be called a "pallet".
Arcuru 3mo ago
Since I don't see it mentioned yet, https://blessed.rs https://blessed.rs seems to be pretty popular for finding common/recommended crates in the Rust ecosystem.
fleventynine 3mo ago
I don't think this does enough to address to supply-chain security concerns. Before I use a crate, I want some assurance that the transitive deps have had a proper security audit, and that I'm not a single "cargo update" away from getting malware installed in my machine.

two_handfuls 3mo ago

For those struggling for context like me: this is about the Rust programming language.

deleted 3mo ago
[deleted]

deleted 3mo ago

[deleted]

wseqyrku 3mo ago

Off we go comparing battery packs. Seriously though, I wish the dual futures, streams types to be consolidated first than building anything on top of the situation.

eptcyka 3mo ago
Futures would be less of a problem if async was implemented as effect handling instead of coloring functions - I am truly miffed about e.g. not being to use `or_insert_with` with a fallible async function. That and build sandboxing are my 2 pie in the sky dreams for a rust edition far, far away.
- wseqyrku 3mo ago
  > if async was implemented as effect handling By any chance, was there a proposal for that I could read?

yjftsjthsd-h 3mo ago

> Battery packs are meant to address one of the most common things I hear from new Rust adopters. Everyone loves the wealth of high-quality crates available on crates.io. And everyone hates having to spend a bunch of time researching and comparing alternatives. > [...] > One of the key ideas from battery packs is that anybody can publish one. So now we get to research and compare alternative battery packs? I guess it could help if there's fewer of them, but I don't see why that would be.

zem 3mo ago
at the very least you could follow some trusted entity's recommendation for a bunch of crates at once. e.g. if the author of some large rust project like bevy published a battery pack I would pay attention because they have had to solve the problem of picking out several crates and seeing that they all work well together.

ho_lee_phuk 3mo ago

Go ecosystems seems to choose quality over quantity (fewer higher-quality libraries) over Rust. What seems to be causing this?

olalonde 3mo ago
I'd say ease of package management. You can see this with Python too.
- inigyou 3mo ago
  Package management is easier in Go than almost any other ecosystem, including Rust, Python and Javascript. And Go projects may have tens of package dependencies. Yet it's closer to a C++ project which has single-digit dependencies than a Javascript project which has tens of thousands.
  - olalonde 3mo ago
    Interesting. When I learned Go a while ago, it didn't have a package manager. You just pulled down master branches directly into your global GOPATH. So pulling in a dependency was a big decision and people naturally favored "batteries included" libraries. That probably still permeates the culture today.
    - inigyou 3mo ago
      That is the package manager. The package has a URL. You import the URL and you're done.
      - olalonde 3mo ago
        Back then there was no versioning. When you imported a URL, you had to hope that all your projects and transient dependencies happened to be compatible with whatever commit was currently sitting on the master branch. Because one update could silently break an unrelated project on your machine, adding a dependency was a bigger decision. That naturally led the ecosystem to favor fewer, larger libraries. PS: it looks like this issue was addressed in 2019 with the introduction of Go Modules.

rickdeckard 3mo ago

The hobbyist device maker in me took waaay to long to be certain that this is NOT about physical batteries... (was already confident, then there's suddenly a screenshot mentioning display components)

RunSet 3mo ago
Reminds me of how calling wine prefixes "bottles" makes things easier to someone.
- tomashubelbauer 3mo ago
  Homebrew is also great in this regard
  - bennettnate5 3mo ago
    Yeah, I definitely think "pallets" would make more sense in this context.
cursuve 3mo ago
Ha- same here! I was very excited to see a curated list of battery configurations/cells/wiring diagrams!

Levitating 3mo ago

In my opinion this will just worsen the ecosystem. Many Rust crates are already bloated with dependencies.

assbuttbuttass 3mo ago

Sounds like a great way to get dozens of dependencies before you even write a line of code

functionmouse 3mo ago
It's about boosting attack surface. Trust the plan :)

tialaramex 3mo ago

I hope one day to coincidentally have an earworm which works as sub-headings for something I want to write about.

cold_pizz4 3mo ago

Everybody agrees that Rust's ecosystem is too fragmented, but I don't think that the solution proposed here will solve anything. The most promising project to solve this problem is https://github.com/rust-stdx/stdx https://github.com/rust-stdx/stdx which is (more or less) re-creating Go's standard library in Rust.

jvanderbot 3mo ago
You're advocating for one solution that has two problems: * It is precisely what TFA goes in for: a one-stop shop (somewhat application dependent) * It is antithetical to the "embarassment of riches" approach that Rust tried for when they delegated almost all functionality to crates - the ecosystem has proven fruitful Oh and a third: https://xkcd.com/927/ https://xkcd.com/927/ It seems to me that advocacy, writing good applications, or human-readable guides will do more for convergence on crate bundles than a more technical solution. I reach for the crates I know, not yet-another-framework.
chrismorgan 3mo ago
The guy that is making stdx has been doing various shady stuff in his books and code which have resulted in all his stuff being banned on /r/rust. In stdx, he’s been forking good code, violating licenses, completely rewriting stuff with LLMs (including cryptography code, and definitely introducing bugs in the process)… it’s not a good approach.

efaref 3mo ago

I guess the name is intending to evoke the "batteries included" metaphor, but it seems pretty terrible to me. If we're sticking with the crates/cargo metaphor, surely this should be called a "pallet".

Arcuru 3mo ago

Since I don't see it mentioned yet, https://blessed.rs https://blessed.rs seems to be pretty popular for finding common/recommended crates in the Rust ecosystem.

fleventynine 3mo ago

I don't think this does enough to address to supply-chain security concerns. Before I use a crate, I want some assurance that the transitive deps have had a proper security audit, and that I'm not a single "cargo update" away from getting malware installed in my machine.