Rust adoption is stagnating not because it's missing some feature pushed by programming language theory enthusiasts, but because of a lack of focus on solving the practical problems that developers are facing every day.

... no company outside of AWS is making SDKs for Rust ... it has no official HTTP library.

As a result of Rust's lack of official packages, even its core infrastructure components need to import hundreds of third-party crates.

cargo imports over 400 crates.

crates.io has over 500 transitive dependencies.

...the offical libsignal (from the Signal messaging app) uses 500 third-party packages.

... what is really inside these packages. It has been found last month that among the 999 most popular packages on crates.io, the content of around 20% of these doesn't even match the content of their Git repository.

...how I would do it (there may be better ways):

A stdx (for std eXtended) under the rust-lang organization containing the most-needed packages. ... to make it secure: all packages in stdx can only import packages from std or stdx. No third-party imports. No supply-chain risks.

[stdx packages to include, among others]:

gzip, hex, http, json, net, rand

Read Rust has a HUGE supply chain security problem

Submitter's note:

I find the author's writing style immature, sensationalist, and tiresome, but they raise a number of what appear to be solid points, some of which are highlighted above.

you are viewing a single comment's thread
view the rest of the comments

[–] FizzyOrange@programming.dev 31 points 4 months ago (8 children)

Rust adoption is stagnating

Is it? I would like to see some evidence for that.

because of [the small standard library and potentially supply chain security issues]

Yeah I can guarantee that is not a significant reason for people to avoid Rust. If it was people wouldn't use NPM, where the problem is even worse.

I do think it would be good to putt some more stuff in the standard library makes sense, or even just add some kind of official sanction of de facto standard library crates like regex.... But this author is an idiot.

[–] sgued@pouet.chapril.org 2 points 3 months ago (1 children)

@FizzyOrange @ericjmorey The Regex crate is already part of the rust-lang organisation on GitHub. I don't know what you are asking for.

[–] FizzyOrange@programming.dev 1 points 3 months ago (1 children)

I am asking for some kind of official badge or something on crates.io. Currently it just looks like any other crate. Dart has a feature like this I believe.

And regex was just an example. There are other crates that should be officially sanctioned but aren't.

[–] sgued@pouet.chapril.org 1 points 3 months ago (1 children)

@FizzyOrange@programming.de It's shown in the "owners".

Regarding the crates that should be "officially sanctionned", what would this mean besides a fancy badge?

[–] FizzyOrange@programming.dev 1 points 3 months ago (1 children)

It would mean a fancy badge, ideally being listed in the official docs, and probably some kind of promise about maintaining it.

It’s shown in the “owners”.

This is just way too subtle IMO.

[–] sgued@pouet.chapril.org 0 points 3 months ago (2 children)

@FizzyOrange the Rust project is not an organisation you have a contract with. The only guarantee of maintenance you get are that of the MIT and Apache licenses.

[–] sgued@pouet.chapril.org 1 points 3 months ago

@FizzyOrange And a lot of crates you would want to see "blessed", are already in the Rust cookbook: https://rust-lang-nursery.github.io/rust-cookbook/

[–] FizzyOrange@programming.dev 1 points 3 months ago

I clearly didn't mean a legal contract. Come on.

load more comments (6 replies)