Just as web developers, of all people, are finally, after over a decade, coming to the conclusion that arbitrarily-packaged dependencies are a bad idea for so many obvious reasons, Rust developers are trying to replicate NPM in the kernel.
I was told that Rust in the kernel would be a good thing, and that not much would change. If these are the types of people who are writing Rust for the kernel... can we go back? I really want to go back.
The article states:
> The Rust-for-Linux developers understand this situation and are not envisioning adding the ability to pull in modules with a tool like Cargo
Some? Dependency graphs of well over a hundred packages are ubiquitous. I've long since stopped being surprised when I compile a rust package that makes no network connections and see it (indirectly) pulling in multiple HTTPS libraries.
Tad understated. Popular rust http frameworks with basic functionality are hitting 300+ deps straight off the bat easily.
For the security conscious, move to vendoring or alias cargo to always run in offline mode.
Web developers and Rust developers are the same group
Not that I agree with Rust's adoption at that level, as I think languages with automatic memory management make more sense, but that's me.
If anything, it is the pseudo-macro Assembler approach to C's design that made it a scary experience for some developers.