Remix.run Logo
amusingimpala75 3 hours ago

This is probably going to sound generic / repetitive, but my biggest complaint about Rust is the package management situation, which is entirely the result of the developer mindset. I love the ergonomics on the rust side (the functional approach to data types is beautiful), but I’m working on two projects side by side, one in rust and one in go at the moment. The dependency trees are entirely different beasts, with most of the stuff on the go project covered by the stdlib whereas I think the rust project is over 400 despite asking for just rusqlite (sqlite), clap (cli), ratatui (tui), and tauri (gui), the last of which is by far the worst offender but even without it, it’s still close on 100 which is crazy. If there were (and maybe there are, I just haven’t found them) decently maintained alternatives to the rust crates that actually have a sane dependency approach, I’d feel much better. I’m just trying to not shai hulud my system, and the rust-web people seem to want to turn cargo into npm in that regard.

praseodym 2 hours ago | parent | next [-]

Note that many Rust libraries consist of multiple crates, which all end up in the dependency graph. This makes the number of dependencies seem higher than it actually is: the separate crates have the same maintainers and are often part of the same upstream git repo.

I agree with the general sentiment though. Rust also has a lot of crates that are stuck semi-unmaintained at some 0.x version, often with no better alternative.

vlovich123 2 hours ago | parent | next [-]

Unfortunately the 0.x version has pervaded because of community cargo culting claiming that versioning is easier with 0.x than with major version numbers > 0. Personally I find that hard to believe, especially given packages like Tokio and anyhow (still at v1) make it work and there’s others that are >v1.

That is to say 0.x doesn’t necessarily mean unmaintained, it can also mean “I don’t want to have to think about how to version APIs / make guarantees about APIs). Eg reqwest is very widely used and actively maintained yet is still at v0.13.

nicoburns 11 minutes ago | parent [-]

> claiming that versioning is easier with 0.x than with major version numbers > 0

I think it's less that versioning is claimed to be easier with 0.x versions, and more that some people have got into their heads that 1.0 signals either "permanently stable" or "no new versions for several years" and they don't want to commit to that yet.

I do wish more crates would 1.0 (and then 2.0, etc).

J_Shelby_J 2 hours ago | parent | prev [-]

There is good reasons to break out projects into multiple crates. It makes reusing functionality elsewhere easier. It makes it easier to reason about behavior. It makes it easier for LLMs to understand (either working within the crate or consuming as an api surface.) So you end up with projects that have multiple crates inside the same workspace and it really blows up dependency count.

nicoburns 10 minutes ago | parent [-]

The other very important reason for splitting into crates is compile times. Crates are the "compilation unit" and you often get more build paralellism with more crates.

OtomotO 2 hours ago | parent | prev | next [-]

The stdlib is the place where good ideas go to die.

And then you have httplib3 followed by httplib4.

In other words: I highly prefer the Rust approach.

It doesn't matter a lot whether I rely on the stdlib or another dependency to me.

It's a dependency after all.

People think just because it's the stdlib it's somehow better quality or better maintained, but these are orthogonal concepts.

In the end it depends solely on resources.

Sure, the stdlib may get more of these, but it may also grow fat and unmaintainable...

2 hours ago | parent [-]
[deleted]
ViewTrick1002 2 hours ago | parent | prev | next [-]

> rusqlite (sqlite), clap (cli), ratatui (tui), and tauri (gui)

Does any language, except like Java, exist with a standard library comprising matching that?

Also, keep in mind that Tauri itself is 14 crates, where each one shows up in your build tree.

https://github.com/tauri-apps/tauri/blob/dev/Cargo.toml

And Ratatui is 6:

https://github.com/ratatui/ratatui/blob/main/Cargo.toml

PyWoody an hour ago | parent [-]

Python has sqlite3[0], curses (tui) [1], and tkinter[2] in the stdlib.

[0] https://docs.python.org/3/library/sqlite3.html

[1] https://docs.python.org/3/library/curses.html

[2] https://docs.python.org/3/library/tkinter.html

ViewTrick1002 an hour ago | parent [-]

Right. The famous stdlib where once good libraries go to die so you instead depend on the latest community replacement choice.

Also argparse for Clap:

https://docs.python.org/3/library/argparse.html

awesome_dude 2 hours ago | parent | prev | next [-]

Package management is the bane of nearly every language/technology

Nobody has "solved" it, and I don't think that there will ever be one (never say never, though, right?)

For Go we rely on developers of libraries to adhere to the semver versioning scheme accurately, and we cannot "pin" versions (a personal bugbear of mine)

There is a couple of workarounds - using SHAs not unlike the git commit hash to provide a pseudo version, and, vendoring (which is a cache of known dependencies - which brings with it cache management problems)

I had the misfortune of having to use Python with a virtual env on the weekend - it did not end well, and reminded me why I migrated away from Python.

Look at Perl (cpan) Java (maven, gradle) Ruby (gems) Go (dep, glide, vgo, modules) Rust (cargo) Node (npm, yarn, etc)

OSes too Redhat (yum, rpm, etc) Debian (apt) Ubuntu (snap - god why????)

And so on

corndoge 2 hours ago | parent [-]

Nix solved it. Languages could choose to adopt Nix as their packaging system.

tadfisher an hour ago | parent [-]

It did and didn't. Nix tools for building language-specific packages almost always wrap the language build tool/package manager. This can be easy or hard, depending on how onerous the build tool is for vendoring libraries.

What Nix and build tools need to agree on is a specification or protocol for "building a software dependency tree". Like, I should be able to say 'builder = cargo' in a Nix derivation and Cargo should be able to pick up everything it needs from the build environment. Alas, there is simply far too much tied up in nixpkg's stdenv for this to be viable, so we have magic stdenv builder behavior via hooks when a build tool is included in nativeBuildInputs.

awesome_dude 39 minutes ago | parent [-]

I think one of the key problems too is that a system level dependency is managed by people dedicated to ensuring the chaotic nature of the package they are responsible for conforms to the way the OS they are maintaining for has proscribed.

There's no real way to do that at a language level - we cannot have "Go has determined the package you are trying to fix has not met the versioning requirements proscribed so you cannot submit the patch to fix it"

What language dependencies do is what OSes would think of as "unofficial versioning" that is, an OS will let you install and run an unofficial version of some lib (we've all been there, right, multiple versions of some core library because one doesn't work with whatever you are trying to install), but they will not manage it at all.

repelsteeltje 2 hours ago | parent | prev | next [-]

Interesting. I'm not very familiar with Go. What is the equivalent for Tauri in Go's stdlib?

Would it make sense to continue using Go for the frontend and doing only the backend in Rust for your user case?

fatty_patty89 2 hours ago | parent [-]

wails, there's wails3-alpha which some people said is even better than tauri

repelsteeltje 2 hours ago | parent [-]

Thanks. Is wails a Go stdlib component, as GP implied or is it third party?

fatty_patty89 2 hours ago | parent [-]

tauri isn't stdlib and neither is wails

JuniperMesos 2 hours ago | parent | prev [-]

Why is it worse to import a number of other packages that provide exactly the functionality you need, than to have a large standard library that provides some but not all of the functionality you need, requiring you to still use some large dependencies?

pier25 an hour ago | parent [-]

For example, security. See all the supply chain attacks from the past couple of years.