Rust suffers from the same faults as the JS ecosystem. Any significant crate imports hundreds if not thousands of dependencies. The probability that one of the authors gets targeted by AI-assisted attacks is just too high.
Also most of these dependencies provide a breadth of features that the end package does probably not need.
My experience has been that it has a major advantage, in that freeze + offline actually work properly. You can collect the dependencies you need once, put them in version control and never ever talk to remote registry again
I guess that’s more of a problem if you use all-encompassing frameworks, but normally the things I’m using are very small components where the CVEs either don’t exist or are inconsequential/unexploitable for the programs I’m building
Updating every dependency for every kind of CVE is a brute force method for people and organisations that don’t understand the attack surface of the programs they’re producing
Who is doing what you’re describing? The reason I can confidently freeze and offline stuff is because I’m not taking in whole frameworks, I’m selecting things carefully, and generally do end up reading at least most of the source
And what ‘monitoring’ are you going to be doing besides things like CVEs?
A language without a large stdlib pushes this that functionality into (transitive) dependencies. I hope more language will adopt batteries included approach.
No stdlib will ever include all the "batteries" you need. And large stdlibs have their own set of problems, like stagnation, tying the library version to the language version, backwards compatibility garantees preventing evolution, and either needing a wide range of domain experts to maintain it, or having developers maintain components they don't have a deep understanding of.
I think the sweet spot is having an ecosystem of "blessed" libraries that are reviewed for security and quality, but are versioned independently of the language, and maintained by subject matter experts.
This particular crate (arrayref) seems pretty niche, but also doable in std now.
It lets you take a slice `&[T]` and return a slice with a known number of elements`&[T; N]`. tiny-skia was probably using this to get some SIMD optimizations.
'bs58' jumped out at me as a random looking package name.
It implements the base58 encoding, which is used primarily by... Bitcoin.
I'd love to see the explanation of why "a TUI file manager" needs a crate closely associated with crypto coins and not much else.
It is precisely this kind of thing that makes Rust a no-go for most enterprises.
"I just want a CLI tool."
"Congratulations, your servers are mining crypto!"
PS: bs58 is maintained by one anonymous person and their package is used in just about every Rust crypto library and hence application. Compromise his account in the same manner as the 'xz tools' attack and you could still billions in crypto!
It doesn't actually use it, this is just referencing it in the dependency graph (Cargo.lock). bs58 is an optional (feature-gated) transitive dependency of another crate, which is never referenced at all in the top-level crate. The build.rs doesn't run or anything.
I believe there's (several) open issues about changing this behavior of the lock file, but I have moved on from Rust so don't know the status of things.
That said, this is confusing behavior. I remember I first noticed it when a bunch of crates were showing up in my lock file for every OS under the sun, even though I was specifically using a "wayland" (linux-only) feature.
Not to defend Rust's crazy culture of dependencies, mind you.
The lockfile confusion/bug is indeed a thing, but OP is noting that b58 was downloaded, which makes me think it's actually used.
I ran in to the lockfile bug myself a day ago and noticed that dependency-feature-flagged-crates show up in Cargo.lock, but their crates aren't downloaded.
I don’t know anything about this particular tool. But I’ll note that comparing package counts often doesn’t make sense between ecosystems, since some ecosystems (like Rust) lean heavily towards workspace patterns where several “physical” packages make up one “logical” unit.
(Rust even enforces for proc macros, which is why so many of the crates in your example end with “derive” or “macros.”)
I use nnn[0], a C tui file manager, and from the makefiles, you mostly need
readline
pcre
ncurses
pthread
and POSIX (and some unix thingies)
Which is why I love C projects, even with all the footguns. You have libraries with nice API that lets you write software without being on a treadmill to update the code every few months.
In my opinion, library authors should really minimize the amount of dependencies they have. Back to TypeScript, we are also the authors of https://github.com/okcontract/cells and we made a point of almost not having dependencies or even devDependencies.
This. I don't see the point of using a Pixel Watch or an Apple Watch or any watch that has 1 or 2 days of battery max.
My 3 year old Garmin has 2+ weeks battery life and is tracking activity, ox (ok, it's not medical grade), sleep, etc.
Also it does _not_ have a mic (something we're going to pay extra in a few years the way things go) and is not connected to anything wirelessly. No need for another device to set it up and you decide when you get data out using USB.
Actual price $100k and everything is very closed and proprietary. Oddly this MSI system provides "only" 252G vram and 500G ram. I would have expected more vram for this price. Also why 252 instead of 256? https://www.centralcomputer.com/msi-xpertstation-ws300-ai-wo...
Reminds of Chris Lemons, who survived for 30+ minutes without oxygen at the bottom of the North Sea. Cold water (and experience, like staying calm) probably played a large part.
He went back to diving a few weeks after!
I haven't done any in-depth synthetic benchmarks but I had my Hermes agent run some and I ran a couple directly on the LLM Gateway that showed similar results.
Hermes reported 18.45 tok/s consuming the llama-swap endpoint across the wire. Locally I got 19-19.1 tok/s on the gateway. I'm running the Qwen 3.6 27B Q6 model (qwen3-6-27b-q6-k) off LM Studio and it's less than 0.3s to first token.
It's not good for conversational use cases as it can take 1-2 minutes to respond to a prompt.
I have two Hermes Profiles running, one is a personal assistant that manages my backlog and provides me morning reminders, solicits for evening updates, and will run overnight research projects for me. The other profile is a coding helper for personal projects. I can ask it to make changes and it will churn for 15 minutes, submit a PR, and notify me that the PR is ready to review. It's faster than me at basic coding tasks.
https://gist.github.com/hbbio/2faf096cbb77e197233ab9a2958beb...
reply