undefined | Better HN

0 pointsoctoberfranklin5y ago0 comments

Wow, yeah, that's exactly the technological aspect of what I had in mind.

I guess all that's left is the socialogical aspect: packages' "geiger" status ought to be treated as being as important as their dependencies. In other words, lib.rs/docs.rs/crates.io ought to display these data in all the sorts of places where they list the dependencies of a package.

It would also be great if this tool were made a standard part of cargo. I think it's important enough to deserve that status.

0 comments

3 comments · 1 top-level

sitkack5y ago· 2 in thread

I think this would be a docs.rs or lib.rs feature, I used to think crates.io was that place but it is not.

I could see there being all kinds of scans of dependencies, like enforcing test coverage, builds and tests passing on certain platforms (risc-v, wasi, etc).

octoberfranklinOP5y ago

No, see, my point is that this is as important as dependencies.

Anything that tracks dependencies ought to be tracking transitive unsafeness.

That's the mindset shift the Rust world needs. Otherwise we're going to keep getting these (in some sense valid) complaints about how Rust isn't memory-safe because it has unsafe-blocks.

sitkack5y ago

Safety is top of mind for a large percentage of the Rust community. There was major political drama when the fastest http framework liberally used unsafe. That framework was almost universally shunned because of it and now the vast majority of the use of unsafe in that project have been removed. I think we are in a good position, but there could be in effect, a Sybil attack against norms where if unsafe was an Ok thing to do for perf or expediency that the value of Rust would be largely obliterated.

My personal hope is that lib.rs and docs.rs replace crates.io and that safety, code coverage, perf and other dimensions of quality are prominently displayed and queryable. Crates.io as it is now has outlived its usefulness.

I believe you and I agree on this issue completely.

j / k navigate · click thread line to collapse