Post #2336867
2026-03-31 15:33 UTC
Another go-around of the discourse around dependency counts.
Vendoring is a terrible idea, it gets in the way of automated dependency scanners that would help you find out about vulnerabilities. Having to vendor is a bug report to you package manager, as it clearly is lacking some feature.
Counting 100 100 line long crates all by the same authors as inherently more dangerous than 1 10000 line long crate makes no sense to me.
Replies (1)
-
@ekuber@hachyderm.io 2026-03-31 15:34
#Rust crates that vendor C code and build it in their build.rs should *not* make them the default. Instead they should attempt to use the system one and bail if that fails, with an error asking people to enable a feature flag to use the vendored dependency. "It just works" invisibly means that people can be unaware that they are including vendored code or that their platform's system packages aren't properly set up. #RustLang