> Battery packs are meant to address one of the most common things I hear from new Rust adopters. Everyone loves the wealth of high-quality crates available on crates.io. And everyone hates having to spend a bunch of time researching and comparing alternatives.
> [...]
> One of the key ideas from battery packs is that anybody can publish one.
So now we get to research and compare alternative battery packs? I guess it could help if there's fewer of them, but I don't see why that would be.
at the very least you could follow some trusted entity's recommendation for a bunch of crates at once. e.g. if the author of some large rust project like bevy published a battery pack I would pay attention because they have had to solve the problem of picking out several crates and seeing that they all work well together.
I don't think this does enough to address to supply-chain security concerns. Before I use a crate, I want some assurance that the
transitive deps have had a proper security audit, and that I'm not a single "cargo update" away from getting malware installed in my machine.
Package management is easier in Go than almost any other ecosystem, including Rust, Python and Javascript. And Go projects may have tens of package dependencies. Yet it's closer to a C++ project which has single-digit dependencies than a Javascript project which has tens of thousands.
Interesting. When I learned Go a while ago, it didn't have a package manager. You just pulled down master branches directly into your global GOPATH. So pulling in a dependency was a big decision and people naturally favored "batteries included" libraries. That probably still permeates the culture today.
Back then there was no versioning. When you imported a URL, you had to hope that all your projects and transient dependencies happened to be compatible with whatever commit was currently sitting on the master branch. Because one update could silently break an unrelated project on your machine, adding a dependency was a bigger decision. That naturally led the ecosystem to favor fewer, larger libraries.
PS: it looks like this issue was addressed in 2019 with the introduction of Go Modules.
Futures would be less of a problem if async was implemented as effect handling instead of coloring functions - I am truly miffed about e.g. not being to use `or_insert_with` with a fallible async function. That and build sandboxing are my 2 pie in the sky dreams for a rust edition far, far away.
Everybody agrees that Rust's ecosystem is too fragmented, but I don't think that the solution proposed here will solve anything.
The most promising project to solve this problem is https://github.com/rust-stdx/stdx which is (more or less) re-creating Go's standard library in Rust.
The guy that is making stdx has been doing various shady stuff in his books and code which have resulted in all his stuff being banned on /r/rust. In stdx, he’s been forking good code, violating licenses, completely rewriting stuff with LLMs (including cryptography code, and definitely introducing bugs in the process)… it’s not a good approach.
You're advocating for one solution that has two problems:
* It is precisely what TFA goes in for: a one-stop shop (somewhat application dependent)
* It is antithetical to the "embarassment of riches" approach that Rust tried for when they delegated almost all functionality to crates - the ecosystem has proven fruitful
It seems to me that advocacy, writing good applications, or human-readable guides will do more for convergence on crate bundles than a more technical solution. I reach for the crates I know, not yet-another-framework.
(was already confident, then there's suddenly a screenshot mentioning display components)