Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface.
  • BB_C
    31·
    8 days ago

    Why do you think cargo is a problem?

    • MonkderVierte@lemmy.zip
      3·
      7 days ago

      Not cargo per se, but even the tutorial for a cli-tool is like “setup clap, which has 20 dependencies and a kitchen sink”. The whole (cargo-centric) ecosystem is much like Node, with the same problems.

      And also, cargo.toml has inconsistencies and double-standards.

      • BB_C
        3·
        7 days ago

        Not cargo per se, but even the tutorial for a cli-tool is like “setup clap, which has 20 dependencies and a kitchen sink”. The whole (cargo-centric) ecosystem is much like Node, with the same problems.

        cargo new with-clap
cd with-clap
cargo add clap --no-default-features

        % cargo tree
with-clap v0.1.0 (/tmp/with-clap)
└── clap v4.6.0
    └── clap_builder v4.6.0
        ├── anstyle v1.0.14
        └── clap_lex v1.1.0

        And also, cargo.toml has inconsistencies and double-standards.

        Can you expand on that?

          • BB_C
            1·
            6 days ago

            I will let you expand on this before responding to both:

            And also, cargo.toml has inconsistencies and double-standards.