|
| ▲ | embedding-shape 3 hours ago | parent | next [-] |
| 326 packages right now when doing a build. Seems large in general, but for a Rust project, not abnormal. Takes what, maybe 15 seconds to compile on a high-core machine from scratch? Isn't the end of the world. Worse is the scope to have to review all those things, if you'd like to use it for your main passwords, that'd be my biggest worry. Luckily most are well established already as far as I can tell. |
| |
| ▲ | elAhmo 21 minutes ago | parent [-] | | "326 seems large, but not abnormal" was the state of JS in the past as well. Chance of someone auditing all of them is virtually zero, and in practice no one audits anything, so you are still effectively blindly trusting that none of those 326 got compromised. |
|
|
| ▲ | xvedejas 3 hours ago | parent | prev | next [-] |
| Does this take into account feature flags when summing LOC? It's common practice in Rust to really only use a subset of a dependency, controlled by compile-time flags. |
| |
| ▲ | gsnedders 2 hours ago | parent [-] | | Also just unit tests in the source files, which again aren’t included in the binary via compile-time flags! |
|
|
| ▲ | traderj0e 2 hours ago | parent | prev [-] |
| For a given tool, I'd expect the Rust version to have even more deps than the JS version because code reuse is more important in a lower-level language. I get the argument that JS users are on average less competent than Rust users, but we're talking about authors who build serious tools/libs in the first place. |
