Mastodawn

Another look at #Rust, another two disappointments:

The standard library specifies that its string type is encoded in UTF8 (good!), but provides no way to work with grapheme clusters and the documentation just points at crates.io… Seriously?

At least the unicode-segmentation-package that seems to be a popular way to get that functionality has a version that indicates that it may be usable for production (that is version ≥ 1.0.0), six owners of which a non-zero number even manage to pass a basic vibe check, and only has dev-dependencies, making this something I’d actually consider using.

Still: This should really be part of the standard library!

Another thing I was then looking at was the random number facilities, which were another disappointment: Not only is it still fully experimental, it is also woefully incomplete and cannot even create a random integer between 1 and 10. This is something extremely basic that should be possible.
I’m not even talking about things like uniform floating point distributions here, let alone stuff like a normal distribution, all of which C++ btw supports directly in the standard library! (Not saying C++ does it all perfectly, but it’s good enough to be useful. This isn’t!)

#Rustlang

crates.io: Rust Package Registry

crates.io serves as a central registry for sharing crates, which are packages or libraries written in Rust that you can use to enhance your projects

Show thread

Benjamin Geer 3d ago

@Fiona I was just at a talk about this, apparently it’s a deliberate design decision to keep the standard library relatively small. Don’t know about grapheme clusters, but for random numbers, the rand crate is good and widely used.

Show thread

Fiona

3d ago

@benjamingeer I am kinda aware, I just think it’s a horrible mindset for a programming language, because it means that the language fails to provide any guidance or common vocabulary. If you search for “random” on crates.io it won’t even show up (or at least not on the first page), and there are over 8000 total results.

And even if you search for it by name, the package is by its own declaration in early development and not ready for production use (Version 0.10.0, see the definition of semver, which I keep having to remind everyone is what the official rust documentation points to!).

Furthermore there is one person listed as owner, meaning the bus-factor here might be 1 (one), which is the opposite of a reliable supply chain. I also don’t know anything about him and whether he is trustworthy.

On the dependency side of things, it has one dependency to rand-core, which is by the same maintainer (fair), and four optional dependencies to other packages; so if I want to have the full feature set, it’s not even enough for me to add this depency, but further ones, increasing the vulnerability of my supply chain even more.

And nothing here is unusual or special about the rand-package, most of these points hold for most things. And that’s why it is so important to have a rich standard library, or at the very least major established projects providing rich libraries. And rust is simply lacking there…

crates.io: Rust Package Registry

crates.io serves as a central registry for sharing crates, which are packages or libraries written in Rust that you can use to enhance your projects

Show thread

Benjamin Geer

@Fiona Those are all fair points. To help you find good crates, there's https://blessed.rs/crates (where rand is the first thing listed), and https://lib.rs, which is a semi-curated directory. As you probably know, the deeper problem is time and money: there aren't enough people getting paid to work on these things for enough time. I also just saw a talk by someone in the Rust compiler team who said that sometimes well-known compiler issues take many years to fix for this reason.

Crate List - Blessed.rs

I also just saw a talk by someone in the Rust compiler team who said that sometimes well-known compiler issues take many years to fix for this reason.I can see that argument and this is fine for a toy project or a niche language.

It is frankly not fine for a language that claims to have security as a high priority and is meant to replace something as well established an mature as C++.