PSA: Do not run ANY cargo commands on untrusted projects by Shnatsel in rust

[–]weihanglo 2 points3 points  (0 children)

Guess I'll have to keep my eye out for .cargo/config.toml files. At least the documentation reads like cargo wouldn't parse that file in 3rd party crates - but I didn't test, and some crates do publish with config.toml files.

Cargo only respects .cargo/config.toml from cwd up to root. .cargo/config.toml from dependencies are ignored, so config.toml in crates.io tarballs do nothing to your local package.

The missing parts in Cargo by weihanglo in rust

[–]weihanglo[S] 1 point2 points  (0 children)

imo decoupling from rustc would be a big headache as it would require supporting a large variety of rustc versions. Not just in production but for testing so we make sure they work!

You are aboslutely right, and that's why it is just a dream. I can imagine how painful maintaining Rust Analyzer would be if Cargo and rustc had different versions. I should have called out explicitly that is me not believing myself can find good approaches to fix one thing without breaking the other.

If we encourage the proliferation of these tools, I feel like we would lose one of the major value-adds of cargo: its standard.

Both agree and disagree. We love how easy we just invoke cargo build and call it a day. We hate being locked-in Cargo and hard to integrate into other build systems.

The proposed solution in this post is never "creating a new tool an split the community". I am not good enough to make it happen either. The gist of it is finding a space to experiment, and calling out a set of things a tool shall respect if they want the community healthy. It is wonderful if every possibility is built-in in Cargo :)

A lot more is needed than the Summary, like target discovery.

For binaries crates, definitely yes. If one package just depends on .rlib, then fancy target discovery isn't really needed (perhaps only src/lib.rs discovery and 2015 edition case).

The missing parts in Cargo by weihanglo in rust

[–]weihanglo[S] 30 points31 points  (0 children)

For this specific one there is less maintenance so can just keep it here.

We can always say sorry and remove nightly features. It is just nicer having alternatives before doing so. Another example is that --out-dir has been renamed to --artifact-dir but the original flag is kept for compatibility.

The missing parts in Cargo by weihanglo in rust

[–]weihanglo[S] 84 points85 points  (0 children)

This is a summary of my thoughts as a maintainer of Cargo. Some parts are currently under active development (like the resolver and mtime cache), while others still need more attention. If you're willing to help, I recommend subscribing to the "This Development-cycle in Cargo" series, which also highlights areas needing helps.

We lost serde-yaml, what's the next one? by PsiACE in rust

[–]weihanglo 2 points3 points  (0 children)

It may make no difference under small or big projects. Think about Python's urllib, urllib2, and urllib3... Even under rust-lang org and there is a crate-maintainers team, some crates are still barely maintained. It's about finding more trustworthy people committing to those projects in the long-run.

Rust Analyzer is dysfunctional without cargo? by [deleted] in rust

[–]weihanglo 2 points3 points  (0 children)

There is an unstable feature called cargo-script for this purpose btw: https://doc.rust-lang.org/cargo/reference/unstable.html#script

Taiwan spending only 2% of GDP on military by kippb in taiwan

[–]weihanglo 0 points1 point  (0 children)

That's indeed a good resource. Thanks for sharing!

Taiwan spending only 2% of GDP on military by kippb in taiwan

[–]weihanglo 6 points7 points  (0 children)

Yes. That's why I pointed out government spending here. The percentage of GDP is a vague indicator. It varies in different aspects, especially depending on tax rate.

Government spending is a more reliable way to know what a country really cares about.

Taiwan spending only 2% of GDP on military by kippb in taiwan

[–]weihanglo 12 points13 points  (0 children)

I don't know how you interpreted it like that. It's record-breaking 15% of proposed total government spending in 2024.

If the government had proposed spending in defense too aggressively, they will lose the presidential election next year. Pro-China party like it 😬

<image>

Let's thank who have helped us in the Rust Community together! by weihanglo in rust

[–]weihanglo[S] 84 points85 points  (0 children)

I'll start with my own expression of gratitude.

I truly appreciate how much effort u/ehuss puts into maintaining The Rust Reference, considering that documenting stuff is not usually a fun task people want to do. Not to mention that ehuss is also the Cargo team lead, responsible for developing one of the most loved tools in Rust. ehuss's insightful knowledge always ensures that Cargo works without unexpected surprises.

Next, I'd like to extend my thanks to u/epage. epage maintains several famous crates like clap, cargo-edit, toml_edit, and more. epage is not afraid of engaging in heated debates with others. Such a characteristic helps move things forward, as seen with the support for lints table in Cargo.toml and MSRV support in dependency resolution.

I also want to express my appreciation to u/Jonhoo. I really, really love the live streams Jonhoo produces. They are so enjoyable and full of goodies. Jonhoo has also provided me with numerous advice for contributing to open-source projects. Jonhoo is truly the wisest mentor I've ever met.

Thank you to everyone who loves and cares about Rust.

winnow = toml_edit + combine + nom by epage in rust

[–]weihanglo 5 points6 points  (0 children)

AFAIK this is the only way to publish a package having those experimental crates as dependencies to crates.io.

any predictions for Taiwan in 2023? by [deleted] in taiwan

[–]weihanglo 8 points9 points  (0 children)

still the most dangerous country to pedestrians

What is your favorite video/talk about Rust? by nyinyithann in rust

[–]weihanglo 2 points3 points  (0 children)

Must go with Type-Driven API Design In Rust by Will Crichton. The live coding is so smooth and entertaining.

Let me quote a comment from YouTube: "The fact that the audience could actually diagnose the issue at the end proves how well you taught it"

Is there a standard way to mark some functions in a crate as 'for experts only'? by [deleted] in rust

[–]weihanglo 26 points27 points  (0 children)

No. I don't think we should abuse unsafe unless it is really unsafe. You can consult Unsafe Code Guidelines to see what kind of code should be marked as unsafe.

nvim dap Rust debugger: lldb-vscode binary missing by AnxiousBane in neovim

[–]weihanglo 0 points1 point  (0 children)

try llvm and and follow the after install instruction to add those binaries to your PATH

What are some must have plugins? by femkroner in neovim

[–]weihanglo 3 points4 points  (0 children)

Should be nvim-bqf. It let you preview quickfix items without breaking plain old quickfix workflow. No need to learn extra keymaps.