There is the odd (genuine) security issue tbf. But they are more of the variant:

“If an attacker is close enough to sneak that on me, then I’m probably already screwed.”

Why are you hallucinating facts?

• There is no “team of 200 rust developers”.
• “<lang> developer” is not an identity.
• uutils is not a “professional” project, as in people are paid by the (non-existing) uutils company to work on it.
• The project started as personal hobby of one person during COVID, There were no 200 contributors who sprung up magically and simultaneously from the start.

They wanted to avoid the “politics” and are not entertaining comments or explaining their decisions. It’s not up for discussion.

If you think you saw a group of 200 people starting uutils and doing this. You should seek medical help.

The “reported upstream” link is broken (fixed link).

mostly compatible with C

It’s not mostly compatible, not even on the surface level, with any version of C post C89. And most of the ever-growing crap in the language came after the early years anyway, with constructs that are C++-exclusive.

compatible with C

myth

I don’t understand the problem.

cargo new tt-build
cd tt-build
cargo new --lib opt-dep
echo 'pub const NAME: &str = "opt-dep";' > opt-dep/src/lib.rs

// build.rs
fn main() {
    #[cfg(feature = "opt_dep_b_ft")]
    println!("cargo:warning={}", opt_dep::NAME);
    #[cfg(not(feature = "opt_dep_b_ft"))]
    println!("cargo:warning=none");
}

// src/main.rs
fn main() {
    #[cfg(feature = "opt_dep_r_ft")]
    println!("Hello with {}", opt_dep::NAME);
    #[cfg(not(feature = "opt_dep_r_ft"))]
    println!("Hello with none");
}

# Cargo.toml
[package]
name = "tt-build"
version = "0.1.0"
edition = "2024"

[features]
default = ["opt_dep_b_ft", "opt_dep_r_ft"]
opt_dep_b_ft= ["dep:opt-dep"]
opt_dep_r_ft= ["dep:opt-dep"]

[dependencies]
opt-dep = { path = "./opt-dep", optional = true }

[build-dependencies]
opt-dep = { path = "./opt-dep", optional = true }

% cargo run --no-default-features 2>&1 | rg 'Hello|warn'
warning: tt-build@0.1.0: none
Hello with none

% cargo run  2>&1 | rg 'Hello|warn'
warning: tt-build@0.1.0: opt-dep
Hello with opt-dep

% cargo run --no-default-features --features=opt_dep_b_ft  2>&1 | rg 'Hello|warn'
warning: tt-build@0.1.0: opt-dep
Hello with none

% cargo run --no-default-features --features=opt_dep_r_ft  2>&1 | rg 'Hello|warn'
warning: tt-build@0.1.0: none
Hello with opt-dep

I will let you expand on this before responding to both:

And also, cargo.toml has inconsistencies and double-standards.

Not cargo per se, but even the tutorial for a cli-tool is like “setup clap, which has 20 dependencies and a kitchen sink”. The whole (cargo-centric) ecosystem is much like Node, with the same problems.

cargo new with-clap
cd with-clap
cargo add clap --no-default-features

% cargo tree
with-clap v0.1.0 (/tmp/with-clap)
└── clap v4.6.0
    └── clap_builder v4.6.0
        ├── anstyle v1.0.14
        └── clap_lex v1.1.0

And also, cargo.toml has inconsistencies and double-standards.

Can you expand on that?

Why do you think cargo is a problem?

Not sure how are you and @kibiz0r@midwest.social coming up with these concerns.

The only correct way to package such software is to vendor dependencies (packaged together or separately). And you can trivially change the sonames of vendored deps in your build scripts so that there are no conflicts whatsoever (I dual-package some stuff against an upstream and a fork and do just that). So dynamic vs. static is not the crux of the issue. The primary concerns are that distributors hate vendoring, irrespective of whether the vendored libs are linked in statically or dynamically. Distributors also hate potentially diverging forks maintained by random downstreams, which is what “patched dependencies” effectively are.

There is always room for some leeway of course, but that would depend on how relevant your software is, and/or whether a maintainer would want to take that burden on.

And finally, sometimes, such dependencies may provide added value that trumps all these concerns. So judging these things is always situational.

Then you could be forced to vendor everything. And if it’s open-source and relevant for distros to pickup, then you will need to find out if distros would be willing to take your library with its vendored libs (or package them separately just for your library)…etc.

And you may need to figure out if there are bus factor concerns with your direct dependency, since such libraries are not necessarily maintenance free, even from a mere compiling/building stand point (what if a patched indirect dependency no longer builds with new compilers…etc).

This would depend on the language/ecosystem. It’s worse for C and C++ than for example Rust because of packaging policies and ease of distributability.

how many real-world attacks happened since the XZ fiasco outside of the webshit ecosystem?

Maybe I missed it, but you don’t seem to mention anywhere sub-file sync (binary diffing) support (or presumably the lack of it), which is very important for fast syncing when files actually change!

Fundamentally the issue is that Future is a n+m model where you have n virtual threads executing on m OS threads. As such traditional solutions to associating data to OS threads like thread locals don’t work as there’s no guarantee that a given virtual thread will continue to execute on any given OS thread.

This is fully runtime/platform dependant and not true in many cases. Not only strictly single-thread runtimes exist, but async is already used in places like the embedded world where there is no OS for there to be OS threads, single or otherwise.

It is for this reason that the extra trait bounds on the implicit impl Future return type in async functions have caused a lot of trouble (implicit Send, …etc). If for nothing else, adding context to the equation would make that situation more complex.

In any case, attaching “metadata” to T: Future data (instead of the runtime or some other global context) doesn’t make any sense in my head, as one would be "await"ing around and the concrete return type is often hidden behind that impl Future. And if the data is really special and needs to be attached to T: Future, then it’s (conceptually) just data that is a part of T, not Future.

• Rust doesn’t do implicit transparent structs. The FutureExt trait methods return a wrapper struct WithContext which is where the data (T) and the context are stored. One method takes context directly from an argument, the other clones one from a thread local. Data can’t hang in thin air to be attached to a triat. This also shows that the abstraction you (presumably) were asking about is both possible and already exists.
• Forcing a context on all T: Future types would make the abstraction non-zero-cost in any case.

It’s not about magic, it’s just not how the abstraction works.

Let’s have a concrete example, poem::web::Data utilizes opentelemetry::context::FutureExt which has the trait methods with_context() and with_current_context(). But where is the data/context actually stored? In the WithContext struct of course. Because there is no such a thing as pinning (meta)data to a trait.

@devnev@lemmy.dbzer0.com ^^

struct SomeFuture;

impl Future for SomeFuture {
  // ....
}

where are you going to “pin metadata”?

Stating the obvious: a trait is type class you implement for types. It’s not something you can “pin metadata” (or any data) to.

source traversal != backtrace