Rust’s dependencies are starting to worry me (vincents.dev)

Article summary

The author expresses concern about the growing number of dependencies in their Rust projects, citing the example of a small web server with 3.6 million lines of code in its dependencies. They question how to audit and maintain such a large amount of code. The author notes that while Cargo makes it easy to add dependencies, it also makes it easy to add too many. The author is unsure of the solution, but mentions that some people call for adding more to the Rust standard library.

Main themes

• Rust dependencies
• dependency management
• code auditing
• standard library
• language design
• security risks
• maintenance burdens
• convenience vs control

What commenters say

• Some developers believe that the ease of adding dependencies in Rust leads to a culture of relying too heavily on external libraries.
• Others argue that the alternative, writing everything from scratch, is impractical and unnecessary.
• The use of containers and sandboxing can help mitigate the risks associated with dependencies.
• There is a perceived trade-off between the convenience of using many small dependencies and the potential security risks and maintenance burdens they introduce.
• A possible solution could be to create a secondary standard library with relaxed stability guarantees.
• Some commenters suggest that the problem is not unique to Rust and that other languages have similar issues with dependencies.
• The importance of careful dependency management and auditing is emphasized.
• There are differing opinions on whether the Rust core team should focus on the core language or also maintain a larger standard library.