back

by uecker·14d ago·view on hn ↗
Sorry, that others are equally bad is not an excuse, and also not that Rust's design makes it more difficult to package. Either you care about security or you don't.
1 comments
My point is that your argument is comparable to faulting Ford for making cars disposable with crumple zones when nobody else has found a better way to meet the crash-safety requirements while satisfying the other requirements too.

As for "and also not that Rust's design makes it more difficult to package", give https://blogs.gentoo.org/mgorny/2012/08/20/the-impact-of-cxx... a read.

TL;DR: It's not a Rust thing. C++ suffers from the same problem when you use templates in your APIs... it just emits a .so file with no contents if you expose only templated APIs. It's fundamentally a problem of "Unless you're willing to spend Swift-level engineering money and still accept compromises Rust and C++ can't afford, dynamic linking in the presence of monomorphic generics is a problem even research languages haven't solved".

...same as the warts in async Rust. What you're seeing is a cutting-edge language slamming up against the limitations of what cutting-edge programming language research has figured out.

At least, with Rust, you've still got the dependency tracking and automatic RUSTSEC advisory tooling you don't get with header-only C libraries.