Lobsters is a community-driven platform for sharing and discussing links to articles, tutorials, and projects related to technology and programming. Readers can learn about a wide range of topics, from software development and system administration to cybersecurity and artificial intelligence. With user submissions, comments, and voting, Lobsters provides a platform for collaborative learning and knowledge sharing among technology enthusiasts.

Lobsters

The post expresses concerns about managing dependencies in Rust projects, emphasizing issues with unmaintained crates and the large amount of code introduced by dependencies. The author discusses their experience with Rust's ecosystem, including tools like Cargo for package management. They highlight the challenges of auditing extensive codebases that result from using numerous dependencies and suggest that while adding features to the Rust standard library might help, it carries its own challenges.

Rust Dependencies Scare Me

<p>Hm, consider the alternative - what about all that if it wouldn’t be rust but c++ for example. You would also depend on other libraries that also depend on other libraries. Consider all the functionality of your project and the alternatives in the corresponding ecosystem - do you really think the amount of dependencies would drop and the corresponding risks of supply chain vulnerability would sink?
Another thought - would it have been that easy to find this problem in another ecosystem, like c++? Or would you simply write more yourself? Then what about your own code? Is it always safer than 3rd party code?
Verbosity of dependencies is an advantage IMHO. And the fact you identified and solved the problem, shows things can work - without reiinventing the wheel, in an efficient and safe language.</p>


<p>Yeah; that’s the problem with a dependency tree. There are tools to audit dependency trees, and I think Rust crates can be more easily audited due to language design. That being said, it’s an inescapable problem of any dependency tree. Unless all dependencies are internal, but that isn’t the usual case.</p>
