Hacker News Reader

Comment by henning | Hacker News Reader

I automatically don't want to use this database because the number of third party dependencies are an unfixable, never-ending source of security vulnerabilities.

View on HN

Sometimes I'm pretty sure people upvote stories just to see what happens in the comments.

Guilty as charged.

Guilty as charged. To steal a phrase from Reddit, "the true LPT is in the comments"

The true insightful discussion comes in the comments.

LPT?

I believe it means Life Pro Tip.

Yes, the amount of effort it takes to audit dependencies scales roughly linearly, so unless you're going to blindly install them, choosing to use a project with so many dependencies means taking on a tremendous amount of ongoing work.

> the amount of effort it takes to audit dependencies scales roughly linearly

With the lines of code, not the number of dependencies. 10 dependencies of 100 lines of code are arguably easier, but certainly not harder than a single dependency of 1000 lines of code.

I should clarify that I mean auditing dependency-publisher authentication, rather than full code review.

This returns us to status quo ante, back before supply chain attacks were something we worried about. Bugs and such from dependencies are an annoyance but a manageable problem. Supply chain attacks after publisher account compromise are catastrophic and are not manageable.

I see, I have a different mental model for what auditing a dependency means. Auditing is "review the code and release processes of my dependency". In my mind what you describe would be "validating my Software Bill of Materials". It doesn't mean that either of us is wrong on what we call auditing, it just explains why sometimes we end up talking past each other in these conversations.

> auditing dependency-publisher authentication

What does this mean?

It means you'll trust the random people pushing code to cargo if you can prove they indeed are the random people they claim to be?

When a primary dependency is added to a project, its publishers are evaluated for trustworthiness; it's possible that a dependency might be ruled out if its authors seem sketchy or insufficiently concerned with security. Different organizations might have different standards for what they'd accept, but in any case, this evaluation only needs to happen once.

Afterwards, it suffices to validate with each dependency update that the publisher is the same publisher that was evaluated before.

Nowadays this applies to everything that depends on modules that depend on more modules (e.g. NodeJS).

yeah, rust copied the dumpster fire that was npm, i shudder to think of the future of supply chain security when people say rewrite it in rust.

What would a better model to manage dependencies in your opinion? I do like that is easy to add dependencies, but also don't like that a simple hello world Axum app IIRC is around 150 dependencies.

You don't have to have a solution to recognize that there is a problem.

This is both right and wrong in a pernicious way.

When pointing out a problem, you don't necessarily need to provide a better solution. However, if you refrain from providing a better solution, you are still implicitly asserting that there exists some better solution.

So then it's possible to counter that with: a better solution may not exist. If you think a better solution does exist, then the burden of proof is on you to point out an existing solution that does better, or to otherwise establish that some better solution must exist.

Rust could very well be at a global optimum for the problems it's trying to solve. Sometimes tradeoffs are just inevitable.

it may be that rust tried to solve for the wrong problems, so while it may be at the global optimum, the foundation is just broken.

that said, design choices like a flat package namespace are inexcusable. even npm started to move away from it.

I would say, evaluate how much work it would take to build it yourself, and if that is larger than your scope allows ask yourself some serious questions about whether the solution you came up with is overly complex.

Some problems are hard to solve. But not all of them are.

An example, and this is an observation. Where can I grab a library that just parses parses HTTP 1.0, HTTP 1.1 and HTTP 2.0 messages. Not a HTTP framework, something along the lines of httpparse. I pass it a buffer of bytes and out the other end pops a Result<error, HTTPResponse>.

Sure there are hard problems to solve there but they are API design problems.

I don't need tokio or some sort of web abstraction. If I want to use HTTP as a transport over carrier pidgeon I want to be able to do that with said library.

Doesn't exactly exist though and because everyone just pulls in Tokio( I do mean the entire Tower stack or whatever it's called these says) nobody even notices the issue. And every single HTTP server rewrites that functionality with slightly different edge cases and bugs.

That's basic internet infrastructure right there and we can't get a conical library for that yet you are arguing that 3 different implementations of the aame hash function pulled into the same project is viable?

Rust's problems are not necessarily dependency management, cargo is actually great at it, but that they rely on third party dependencies for critical components (like regex and async). Which makes it very difficult to build anything without 300 dependencies.

I understand why they do it. It's lead to some amazing crates like serde. But I think I fall more in the camp of Python, Go or Odin with a comprehensive standard lib. You can make a whole game with Odin with standard library only. Or an entire web app in Go.

> but that they rely on third party dependencies for critical components (like regex and async).

Regex is not a third-party dependency:

https://github.com/rust-lang/regex

My bad. Maybe I was thinking about regex extensions crate.

have an ecosystem that encourages larger, more well thought out dependencies.

the thin standard library and flat package namespace encourages land grabs for short memorable names for packages that just do a single thing. compared to say java or go where dependencies don't exist because they sound cool but because they solve a real problem.

I'm pretty sure everybody just copied from Perl.

Go did something nice, and it would be good if more people copied. But it was also fairly recent.

Almost - CTAN (T for "TeX") predated CPAN by about 1 year (but may not have ever had as much automated fetching involved).

Reply on news.ycombinator.com