HACKER Q&A
📣 Raed667

Why don't people complain as much about Rust cargos?


I just cloned a project that connects to a DB and exposes an REST endpoint.

I wanted to run it, but I had to install and compile around 270 dependencies (which took quite a bit on a Macbook Air).

I've only read praise of Rust and its cargo packages. Whilst node_modules have the worst reputation.

Am I missing something or is it just that Node is way more used than Rust?

  👤 armchairhacker Accepted Answer ✓
No you're right, 270 dependencies for that project is overwhelming. The reason people don't complain as much about Rust cargo is simply that less people use Rust so your situation happens less often.

The package manager isn't the issue: both cargo and npm are actually really great package managers, and the fact someone can easily install 270 dependencies is a good thing. The buggy packages and packages which pull in needless dependencies are the ones which deserve the complaints. C doesn't even have a package manager, but someone could create a bloated C project, copy in 20000 C scripts from various repos (many of which get completely ignored), and you would have the same issue. And honestly I do think a lot of C projects I download from APK have unused, buggy, and old dependencies... (e.g. R project, GTK)

👤 db48x
We measure software based on the features and bugs it has. The number of dependencies it uses to implement those features doesn’t matter. If it has bugs, we don’t care if the bug was introduced by one of those dependencies either. Likewise we shouldn’t care where the compile time comes from.

When you are writing software you might decide that you need some facility, maybe a hash table or an HTTP parser or something. You can either write it yourself or you can pull in a dependency written by someone else. Either way the code will be more or less the same size and take the same amount of time to compile, so that’s rarely a consideration. Dependency managers like cargo and npm take away all of the pain of downloading the code and integrating it into yours, so that’s not a concern either (if you were writing in C it would be a huge concern).

The only thing you as a programmer have left to be concerned about is quality. You might find that the dependency is poorly implemented, buggy, incomplete, etc. One of the good things about cargo and npm both is that they encourage packages to be open–source. This means that we can pick and choose those packages that are of acceptable quality, and improve them as needed. In the old days you might be stuck with whatever libraries your boss had purchased, with no recourse if they turned out to be crap.