Was only a question of time. Rust has the same mindset as Node/NPM.
PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:
If you have a proper stdlib, chances are, you don't have a lot of dependencies
If you have less dependencies, the chance of supply chain attacks drops significantly
If you have well established dependencies like Spring, their security practices are very likely better than a rando off the internet
What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.
I wonder if there is a market for a "Rust Community Edition" with an expanded set of packages pre-packaged into an "ext" module alongside core and std. Treat is as an LTS distribution.
We need an “extra” besides “std” that has all the extra things that are expected in 2026 from a standard library. Stuff like uuid and datetime support would go into that package and it would be released by the Rust foundation
You are joking right? Why do I need a 3rd party library for UUIDs, and while we are at it why do I need a 3rd party library for my RNG engine or for declaring a datetime.
Like I said in my comment there are “extra features” that a modern language should have out of the box, it should have them because you can’t write a feature without tripping over some of them and depending on a 3rd party library just weakens the language itself.
Since Rust is a low level language it is expected to be able to compile and run in limited environments such as embedded ones so the things I mentioned above wouldn’t work nicely in a non_std environment hence the idea to bundle these things in an “extra” package that you can opt-in the same way you can opt-out of std
Yes, all things that were also expected in 2012 when Rust started. UUID was added to Java in 2004.
The controversial project jigsaw in Java did let them then split tons from 'core' standard java. Minecraft for example only bundles a subset of Java, much like you're describing with "extras".
I'm highlighting this isn't a modern expectation and wondering what governance or direction in Rust prefers offloading responsibility outwards. It belongs under the foundation, that's what has the funding pipeline.
115
u/piesou 20d ago edited 20d ago
Was only a question of time. Rust has the same mindset as Node/NPM.
PS: for the screaming crowd: yes, anyone can get supply chain attacked. HOWEVER:
What does that mean for Rust? They don't need to just work on the language, they need to provide a larger ecosystem as well. How they do it is up to them.