Hacker News Reader

sfdsfef3f3fon Malicious Rust crate Arrayref runs a build-time payload

> Another frequently made suggestion straight from la-la land is just writing perfect code from the get-go.

The code in those packages is so far from perfect it's absurd. Like most Go developers, you just have extremely low standards.

sfdsfef3f3fon Malicious Rust crate Arrayref runs a build-time payload

Go has a stronger standard library for certain use cases like basic CRUD web applications, but a lot of the Go standard library is also extremely low quality (flag, container, image, json, log, math, path, regexp, sync, time). Many of these aren't usable outside of toy use cases and have weird edge cases all over the place. Over time many will probably get new incompatible versions just like json. The container package in Go is the worst collection library in any mainstream programming language by a huge margin. It's actually astounding how bad it is.

sfdsfef3f3fon Why stdx is not on crates.io

A huge portion of the Go standard library is extremely low quality as well. flag, container, image, json, log, much of math, path, regexp, sync and time are all notoriously low quality and will almost certainly get improved versions similar to encoding/json/v2. The container package alone has to be the worst package included with any major programming language in history. The standard library in general is also riddled with abstractions that don't hold across the various platforms that they claim to support. path and os are particularly awful in this regard.

Also if you go look at any real Go projects they usually use tons of dependencies and they're usually pinned to random git hashes which is its own massive problem.