this post was submitted on 22 Jul 2023
50 points (98.1% liked)
Rust Lang
7 readers
1 users here now
Rules [Developing]
Observe our code of conduct
- Strive to treat others with respect, patience, kindness, and empathy.
- We observe the Rust Project Code of Conduct.
- Submissions must be on-topic
- Posts must reference Rust or relate to things using Rust. For content that does not, use a text post to explain its relevance.
- Post titles should include useful context.
- For Rust questions, use the stickied Q&A thread. [TBD]
- Arts-and-crafts posts are permitted on weekends.
- No meta posts; message the mods instead.
Constructive criticism only
- Criticism is encouraged, though it must be constructive, useful and actionable.
- If criticizing a project on GitHub, you may not link directly to the project’s issue tracker. Please create a read-only mirror and link that instead.
- Keep things in perspective
- A programming language is rarely worth getting worked up over.
- No zealotry or fanaticism.
- Be charitable in intent. Err on the side of giving others the benefit of the doubt.
No endless relitigation
- Avoid re-treading topics that have been long-settled or utterly exhausted.
- Avoid bikeshedding.
- This is not an official Rust forum, and cannot fulfill feature requests. Use the official venues for that.
No low-effort content
- Showing off your new projects is fine
No memes or image macros
- Please find other communities to post memes
No NSFW Content
- There are many other NSFW communities, let’s keep this related to the language
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What's the bad scenario you're worried about here? What type of data you're specifically worried about? Do you expect me to maliciously manipulate the data, or is even well-intentioned curation and use of heuristics somehow not acceptable?
My view on data cleanup is probably very different than other people's, because I've spent a lot (likely too much) time with the crates' data. The pure unadulterated source data is… bad. It's very sparse (most crates don't fill it in). It's full of outdated information (set once and forgotten, wrong for forks). Some crates-io category slugs are pretty misleading, so tons of crates are miscategorized by their own authors:
parsing
is not for file parsers,database
is not for databases.accessibility
…I can't even. Who put ogg parsers, gRPC, garrysmod, RFID readers in there?There are tons of name-squatted crates, ferris guessing games, or just people's baby steps in Rust. If you search on crates.io you often get the pure data of someone publishing a crate years ago and forgetting about it. This is pure, this is ranked objectively, this is curated and subjective.
crates-io shows you plainly only the license of the crate you're looking at. lib.rs goes further and checks if the crate has any dependencies which are GPL, because if a crate says it's MIT but has GPL deps, it actually is GPL.
crates-io shows you repository URL exactly as-is specified in the metadata, which could be inaccurate (in case of forks) or outright fake (someone else's repo). lib.rs checks if the repository URL actually contains the crate or has the same owner as the crate, and will add a link to the true source code if the repo url is suspicious.
crates-io shows owners' names from the free-form name field, so somebody malicious could pretend to be a well-known trusted user. lib.rs only allows display names for established/reputable accounts, and uses login name for new/untrusted accounts.
I think they are worried that some crates may not show up in the search results, either because their author requested their removal, or you decreased their search ranking for political reasons.
And I agree with you that crates.io is not a viable alternative due to the poor quality of the search results. So switching from lib.rs to crates.io doesn't make sense for this reason alone, since crates.io may not display the crate you're looking for either, unless you already know its name.