161
Every dependency you add is a supply chain attack waiting to happen (benhoyt.com)
submitted 7 months ago by to c/programming@programming.dev
30 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 7 months ago (4 children)

Why do you think cargo is a problem?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 7 months ago* (last edited 7 months ago) (3 children)

    Not cargo per se, but even the tutorial for a cli-tool is like "setup clap, which has 20 dependencies and a kitchen sink". The whole (cargo-centric) ecosystem is much like Node, with the same problems.

    And also, cargo.toml has inconsistencies and double-standards.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 7 months ago* (2 children)

    Not cargo per se, but even the tutorial for a cli-tool is like “setup clap, which has 20 dependencies and a kitchen sink”. The whole (cargo-centric) ecosystem is much like Node, with the same problems.

    cargo new with-clap
cd with-clap
cargo add clap --no-default-features

    % cargo tree
with-clap v0.1.0 (/tmp/with-clap)
└── clap v4.6.0
    └── clap_builder v4.6.0
        ├── anstyle v1.0.14
        └── clap_lex v1.1.0

    And also, cargo.toml has inconsistencies and double-standards.

    Can you expand on that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •