> Battery packs are meant to address one of the most common things I hear from new Rust adopters. Everyone loves the wealth of high-quality crates available on crates.io. And everyone hates having to spend a bunch of time researching and comparing alternatives.
> [...]
> One of the key ideas from battery packs is that anybody can publish one.
So now we get to research and compare alternative battery packs? I guess it could help if there's fewer of them, but I don't see why that would be.
at the very least you could follow some trusted entity's recommendation for a bunch of crates at once. e.g. if the author of some large rust project like bevy published a battery pack I would pay attention because they have had to solve the problem of picking out several crates and seeing that they all work well together.
I don't think this does enough to address to supply-chain security concerns. Before I use a crate, I want some assurance that the
transitive deps have had a proper security audit, and that I'm not a single "cargo update" away from getting malware installed in my machine.
Package management is easier in Go than almost any other ecosystem, including Rust, Python and Javascript. And Go projects may have tens of package dependencies. Yet it's closer to a C++ project which has single-digit dependencies than a Javascript project which has tens of thousands.
Interesting. When I learned Go a while ago, it didn't have a package manager. You just pulled down master branches directly into your global GOPATH. So pulling in a dependency was a big decision and people naturally favored "batteries included" libraries. That probably still permeates the culture today.
Back then there was no versioning. When you imported a URL, you had to hope that all your projects and transient dependencies happened to be compatible with whatever commit was currently sitting on the master branch. Because one update could silently break an unrelated project on your machine, adding a dependency was a bigger decision. That naturally led the ecosystem to favor fewer, larger libraries.
PS: it looks like this issue was addressed in 2019 with the introduction of Go Modules.
Futures would be less of a problem if async was implemented as effect handling instead of coloring functions - I am truly miffed about e.g. not being to use `or_insert_with` with a fallible async function. That and build sandboxing are my 2 pie in the sky dreams for a rust edition far, far away.
Everybody agrees that Rust's ecosystem is too fragmented, but I don't think that the solution proposed here will solve anything.
The most promising project to solve this problem is https://github.com/rust-stdx/stdx which is (more or less) re-creating Go's standard library in Rust.
The guy that is making stdx has been doing various shady stuff in his books and code which have resulted in all his stuff being banned on /r/rust. In stdx, he’s been forking good code, violating licenses, completely rewriting stuff with LLMs (including cryptography code, and definitely introducing bugs in the process)… it’s not a good approach.
You're advocating for one solution that has two problems:
* It is precisely what TFA goes in for: a one-stop shop (somewhat application dependent)
* It is antithetical to the "embarassment of riches" approach that Rust tried for when they delegated almost all functionality to crates - the ecosystem has proven fruitful
It seems to me that advocacy, writing good applications, or human-readable guides will do more for convergence on crate bundles than a more technical solution. I reach for the crates I know, not yet-another-framework.
The hobbyist device maker in me took waaay to long to be certain that this is NOT about physical batteries...
(was already confident, then there's suddenly a screenshot mentioning display components)
Ha- same here! I was very excited to see a curated list of battery configurations/cells/wiring diagrams!
Reminds me of how calling wine prefixes "bottles" makes things easier to someone.
Homebrew is also great in this regard
Yeah, I definitely think "pallets" would make more sense in this context.
For those struggling for context like me: this is about the Rust programming language.
> Battery packs are meant to address one of the most common things I hear from new Rust adopters. Everyone loves the wealth of high-quality crates available on crates.io. And everyone hates having to spend a bunch of time researching and comparing alternatives.
> [...]
> One of the key ideas from battery packs is that anybody can publish one.
So now we get to research and compare alternative battery packs? I guess it could help if there's fewer of them, but I don't see why that would be.
at the very least you could follow some trusted entity's recommendation for a bunch of crates at once. e.g. if the author of some large rust project like bevy published a battery pack I would pay attention because they have had to solve the problem of picking out several crates and seeing that they all work well together.
I guess the name is intending to evoke the "batteries included" metaphor, but it seems pretty terrible to me.
If we're sticking with the crates/cargo metaphor, surely this should be called a "pallet".
Since I don't see it mentioned yet, https://blessed.rs seems to be pretty popular for finding common/recommended crates in the Rust ecosystem.
Sounds like a great way to get dozens of dependencies before you even write a line of code
It's about boosting attack surface. Trust the plan :)
I don't think this does enough to address to supply-chain security concerns. Before I use a crate, I want some assurance that the transitive deps have had a proper security audit, and that I'm not a single "cargo update" away from getting malware installed in my machine.
I hope one day to coincidentally have an earworm which works as sub-headings for something I want to write about.
In my opinion this will just worsen the ecosystem. Many Rust crates are already bloated with dependencies.
Go ecosystems seems to choose quality over quantity (fewer higher-quality libraries) over Rust.
What seems to be causing this?
Money dictates personal philosophies.
Rust and Node have too many deps because you can't make a Patreon or Github Sponsors page for contributions to stdlib.
Go is batteries-included because it was made by Google by people with a salary.
The people writing "thousands of small packages are good" are the people making money from the clout of having made thousands of small packages.
What is Python?
It's probably both?
Started famously as batteries-included, until people started realizing there's money in dependencies.
I'm not a lot into Python, though. I still write a lot of it, but I don't really read or participate in its community.
I'd say ease of package management. You can see this with Python too.
Package management is easier in Go than almost any other ecosystem, including Rust, Python and Javascript. And Go projects may have tens of package dependencies. Yet it's closer to a C++ project which has single-digit dependencies than a Javascript project which has tens of thousands.
Interesting. When I learned Go a while ago, it didn't have a package manager. You just pulled down master branches directly into your global GOPATH. So pulling in a dependency was a big decision and people naturally favored "batteries included" libraries. That probably still permeates the culture today.
That is the package manager. The package has a URL. You import the URL and you're done.
Back then there was no versioning. When you imported a URL, you had to hope that all your projects and transient dependencies happened to be compatible with whatever commit was currently sitting on the master branch. Because one update could silently break an unrelated project on your machine, adding a dependency was a bigger decision. That naturally led the ecosystem to favor fewer, larger libraries.
PS: it looks like this issue was addressed in 2019 with the introduction of Go Modules.
Off we go comparing battery packs.
Seriously though, I wish the dual futures, streams types to be consolidated first than building anything on top of the situation.
Futures would be less of a problem if async was implemented as effect handling instead of coloring functions - I am truly miffed about e.g. not being to use `or_insert_with` with a fallible async function. That and build sandboxing are my 2 pie in the sky dreams for a rust edition far, far away.
> if async was implemented as effect handling
By any chance, was there a proposal for that I could read?
Everybody agrees that Rust's ecosystem is too fragmented, but I don't think that the solution proposed here will solve anything.
The most promising project to solve this problem is https://github.com/rust-stdx/stdx which is (more or less) re-creating Go's standard library in Rust.
The guy that is making stdx has been doing various shady stuff in his books and code which have resulted in all his stuff being banned on /r/rust. In stdx, he’s been forking good code, violating licenses, completely rewriting stuff with LLMs (including cryptography code, and definitely introducing bugs in the process)… it’s not a good approach.
You're advocating for one solution that has two problems:
* It is precisely what TFA goes in for: a one-stop shop (somewhat application dependent)
* It is antithetical to the "embarassment of riches" approach that Rust tried for when they delegated almost all functionality to crates - the ecosystem has proven fruitful
Oh and a third:
https://xkcd.com/927/
It seems to me that advocacy, writing good applications, or human-readable guides will do more for convergence on crate bundles than a more technical solution. I reach for the crates I know, not yet-another-framework.