Post B6zf77vKAA3jtmOCJM by kirby@freerobuxextremist.com
 (DIR) More posts by kirby@freerobuxextremist.com
 (DIR) Post #B6yWKJhYlzUB4u0FbE by phnt@fluffytail.org
       0 likes, 0 repeats
       
       @graf If you need some more safety guarantees without shooting yourself with undefined behavior and can stomach the stupidly long compilation times, then go ahead and use it. Issue is that in most cases where those guarantees really matter, the software also pulls 100+ of random packages that shouldn't even exist. So you exchanged safety guarantees for trusting hundreds of packages to not be compromised instead.
       
 (DIR) Post #B6yWKKrATklWezVRDM by A39IqhddUOQ2Phx7Zo.graf@poa.st
       0 likes, 0 repeats
       
       safety by more supply chain vulnerability, im good
       
 (DIR) Post #B6yWZXjesU4YwmFFvk by jeffcliff@shitposter.world
       1 likes, 0 repeats
       
       @graf @phnt Virtually all crates require github.  You can't get basically *anything* done without microsoft's permission.  Also it's used as an excuse to de-GPL core parts of GNU+Linux ecosystem, and enforce more CoCs on everyone.  These things are not a coincidence.  The "safety" they preach is "safety for microsoft"also they personally came at me for making a meme about hamas.  Very (((sus)))
       
 (DIR) Post #B6yWgMSxAx381SgO7U by phnt@fluffytail.org
       2 likes, 1 repeats
       
       Stop doing language package managers.image.png
       
 (DIR) Post #B6yWitmCIcjHubtTPc by kirby@freerobuxextremist.com
       0 likes, 0 repeats
       
       @phnt FINALLY! A HUMAN DISPLAYS A DAB OF SENSE!!!! :happey:
       
 (DIR) Post #B6zWWFyAUDjUVLcxv6 by SuperDicq@minidisc.tokyo
       0 likes, 0 repeats
       
       @phnt@fluffytail.org People complain languages like C or C++ don't have a single standardized way of managing dependencies, but honestly I think that's a good thing when you see the type of shit that other languages like Rust come up with.
       
 (DIR) Post #B6zf2y8WbpJsO0a64G by histoire3@shota.house
       0 likes, 1 repeats
       
       @kirby@freerobuxextremist.com @phnt@fluffytail.org What, you don't like pip or the multiple npm vulnerabilities
       
 (DIR) Post #B6zf2yjkNR5sFRzp5M by kirby@freerobuxextremist.com
       0 likes, 0 repeats
       
       @histoire3 @phnt user submitted repositories for library bullshit in general is a bad idea
       
 (DIR) Post #B6zf77vKAA3jtmOCJM by kirby@freerobuxextremist.com
       0 likes, 0 repeats
       
       @histoire3 @phnt go has the most sane dependency management model by far but only if GOCACHE=0 is set
       
 (DIR) Post #B6zfG1hwdtLVE8NJ5s by A39IqhddUOQ2Phx7Zo.graf@poa.st
       0 likes, 0 repeats
       
       ok I actually laughed out loud at this
       
 (DIR) Post #B6zfo1l0xsL1E61WXg by phnt@fluffytail.org
       1 likes, 0 repeats
       
       @WandererUber @graf The correctness is mostly just a Rust cult cope. The compiler guarantees almost perfect memory safety and no undefined behavior outside of unsafe code blocks. It doesn't prevent any kind of logic bugs or bad handling of errors whatsoever.
       
 (DIR) Post #B6zhVMT5wBbrrmrvqC by phnt@fluffytail.org
       1 likes, 0 repeats
       
       @kirby @histoire3 You can do centralized-ish package distribution and still make it mostly sane. Hex would be an example of that. In general package managers for languages encourage importing libraries for completely mundane things, which is one of the big reasons why npm and cargo are one of the worst. PyPi's wheel support and allowing shipping binaries in general are also a large problem. If you disalow shipping binaries in/as packages, you get rid of circular dependencies which plague npm and Python to such regard that you can't build certain buildsystems without downloading previous binaries of said buildsystems.