3 ms·

There was a recent talk which explored this question (Dependency Cultures, by Richard Feldman): https://www.youtube.com/watch?v=E82ly38YEEQ https://www.youtube

There was a recent talk which explored this question (Dependency Cultures, by Richard Feldman): https://www.youtube.com/watch?v=E82ly38YEEQ https://www.youtube.com/watch?v=E82ly38YEEQ Summary: it's cultural. Rust likely inherited the practice from Nodejs, who inherited it from Ruby. I think in Rust online spaces in particular there is also this undercurrent of "you're not smart enough to use certain parts of the language, so download libraries that handle that stuff for you."

irishcoffee 1mo ago
[flagged]
- josephg 1mo ago
  > Rust is very much a schlong-measuring contest What? Its just a programming language. Go dependency free if you want. Or vendor everything. Nobody is forcing you to pull in 3rd party dependencies.
  - silverlinex 1mo ago
    [flagged]
    - bayindirh 1mo ago
      As a person who doesn't like Rust very much, no, it doesn't suck. Some of its features make some folks very excited for very right reasons, and evokes "Silver Bullet Syndrome" in others for all the wrong reasons. People weaponizing Rust rewrites with permissive licenses is another problem, but it's not about the programming language itself.
      - silverlinex 1mo ago
        No. It actually does suck. See how opinions work?
- ux266478 1mo ago
  Rust as a language is mostly alright in my opinion. The problems I have with it are similar to the problems I have with C++, and it makes up for them in other really compelling ways. Where it loses me is Cargo and everything surrounding it. I'm essentially forced into an extreme where I just never use anything in the Rust ecosystem, or I have to deal with insane dependency graphs that have the density and microstate complexity of a neutron star.
  - andsoitis 1mo ago
    > Rust as a language is mostly alright in my opinion. > Where it loses me is Cargo and everything surrounding it. High praise!
superxpro12 1mo ago
i'd like to welcome you to the hell that is c/c++ dependency management. Make? cmake? qmake? conf? autoconf? configure? autotools? submodules??? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
- bayindirh 1mo ago
  I'd just select a tool, vendor the libraries I need to the codebase and call it a day. Did these for Eigen, liboption++, Catch2, Easylogging++ (now archived and not maintained anymore, sadly). Build a simple makefile, and you're off to the races. At least, for my cases, that is.
- SSLy 1mo ago
  xmake, build2, whatever msvc and xcode insist upon…
- justinhj 1mo ago
  vcpkg is pretty good. cmake is complex but very flexible. just need an llm to help and it's pretty much solved (if your dep is in autopkg)
- skydhash 1mo ago
  None of those (other than submodules which is just vendoring) does dependency management. They are more configuration management than anything. C, Python, Perl (and maybe ruby?) relies on flag switches and environment variables to find all the necessary files and modules for compiling/running a script. Cmake and autoconf just configure those. With NPM and Rust's focus on project's level dependencies, there's no longer emphasis on API stability. Instead we have breakage every months, forcing everyone on the upgrade treadmill. It's easier to audit C library because they focus mostly on security updates instead of redesigning the API for the nth time.
- nelup20 1mo ago
  Conan, Meson, Ninja, Bazel, meta-build tool / dependency manager #231 etc. etc. And then you have to deal with all the modern C++ and STL footguns. It never ends .·°՞(っ-ᯅ-ς)՞°·.
- 1mo ago
igsomething 1mo ago
The language also takes backwards compatibility very seriously, anything that goes into std "must be maintained forever". It is also argued that a large stdlib means the maintainers have less time to work on the language itself. I understand not every language can have Go's amazing stdlib, but I would much prefer Pyhton's approach where every now and then some package/function from the stdlib gets deprecated/removed. Rust's 3rd party ecosystem is the worst thing from the language, worse than the compile times.
neutronicus 1mo ago
The "npm-ness" of Cargo (centralized and standardized dependency management used at every opportunity) is generally pitched as one of the primary developer experience advantages over C++.
- pjmlp 1mo ago
  For those missing the npm like experience in C, they can use apt, yum, dnf, winget, nuget, conan, vcpkg.
  - kibwen 1mo ago
    In a large enough C codebase, you may even find yourself somehow using all of these simultaneously. :)
    - pjmlp 1mo ago
      Yep.
- tsimionescu 1mo ago
  The thing is, just having a centralized standardized dependency manager doesn't in itself force your ecosystem into this dangerous "micro dependency" pattern. Java'd Maven is also a centralized standardized dependency manager, as is Python's PyPI. However, neither the Java nor the Python ecosystem have devolved into having dependency libraries with 4 methods in them becoming used and required by major libraries.

irishcoffee 1mo ago

[flagged]

josephg 1mo ago
> Rust is very much a schlong-measuring contest What? Its just a programming language. Go dependency free if you want. Or vendor everything. Nobody is forcing you to pull in 3rd party dependencies.
- silverlinex 1mo ago
  [flagged]
  - bayindirh 1mo ago
    As a person who doesn't like Rust very much, no, it doesn't suck. Some of its features make some folks very excited for very right reasons, and evokes "Silver Bullet Syndrome" in others for all the wrong reasons. People weaponizing Rust rewrites with permissive licenses is another problem, but it's not about the programming language itself.
    - silverlinex 1mo ago
      No. It actually does suck. See how opinions work?
ux266478 1mo ago
Rust as a language is mostly alright in my opinion. The problems I have with it are similar to the problems I have with C++, and it makes up for them in other really compelling ways. Where it loses me is Cargo and everything surrounding it. I'm essentially forced into an extreme where I just never use anything in the Rust ecosystem, or I have to deal with insane dependency graphs that have the density and microstate complexity of a neutron star.
- andsoitis 1mo ago
  > Rust as a language is mostly alright in my opinion. > Where it loses me is Cargo and everything surrounding it. High praise!

superxpro12 1mo ago

i'd like to welcome you to the hell that is c/c++ dependency management. Make? cmake? qmake? conf? autoconf? configure? autotools? submodules??? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

bayindirh 1mo ago
I'd just select a tool, vendor the libraries I need to the codebase and call it a day. Did these for Eigen, liboption++, Catch2, Easylogging++ (now archived and not maintained anymore, sadly). Build a simple makefile, and you're off to the races. At least, for my cases, that is.
SSLy 1mo ago
xmake, build2, whatever msvc and xcode insist upon…
justinhj 1mo ago
vcpkg is pretty good. cmake is complex but very flexible. just need an llm to help and it's pretty much solved (if your dep is in autopkg)
skydhash 1mo ago
None of those (other than submodules which is just vendoring) does dependency management. They are more configuration management than anything. C, Python, Perl (and maybe ruby?) relies on flag switches and environment variables to find all the necessary files and modules for compiling/running a script. Cmake and autoconf just configure those. With NPM and Rust's focus on project's level dependencies, there's no longer emphasis on API stability. Instead we have breakage every months, forcing everyone on the upgrade treadmill. It's easier to audit C library because they focus mostly on security updates instead of redesigning the API for the nth time.
nelup20 1mo ago
Conan, Meson, Ninja, Bazel, meta-build tool / dependency manager #231 etc. etc. And then you have to deal with all the modern C++ and STL footguns. It never ends .·°՞(っ-ᯅ-ς)՞°·.
1mo ago

igsomething 1mo ago

The language also takes backwards compatibility very seriously, anything that goes into std "must be maintained forever". It is also argued that a large stdlib means the maintainers have less time to work on the language itself. I understand not every language can have Go's amazing stdlib, but I would much prefer Pyhton's approach where every now and then some package/function from the stdlib gets deprecated/removed. Rust's 3rd party ecosystem is the worst thing from the language, worse than the compile times.

neutronicus 1mo ago

The "npm-ness" of Cargo (centralized and standardized dependency management used at every opportunity) is generally pitched as one of the primary developer experience advantages over C++.

pjmlp 1mo ago
For those missing the npm like experience in C, they can use apt, yum, dnf, winget, nuget, conan, vcpkg.
- kibwen 1mo ago
  In a large enough C codebase, you may even find yourself somehow using all of these simultaneously. :)
  - pjmlp 1mo ago
    Yep.
tsimionescu 1mo ago
The thing is, just having a centralized standardized dependency manager doesn't in itself force your ecosystem into this dangerous "micro dependency" pattern. Java'd Maven is also a centralized standardized dependency manager, as is Python's PyPI. However, neither the Java nor the Python ecosystem have devolved into having dependency libraries with 4 methods in them becoming used and required by major libraries.