
Let's be real about dependencies - steveklabnik
https://wiki.alopex.li/LetsBeRealAboutDependencies
======
marcus_holmes
Really interesting article, but it does treat Go and Rust dependency cultures
as equivalent. Whereas there is a _strong_ preference in Go culture to use as
few dependencies as possible, and preferably only use the standard library. A
Go project using "2-300 dependencies" (cited in TFA as normal for a Rust
project) is incredibly unusual, and would be a cause for concern.

There are regular posts in r/golang from new Go devs asking what frameworks to
use, where to find the list of packages needed to do anything, etc. The
answers are always "just use the standard library".

This is often portrayed as a result of Go's historically relatively poor
package management. But I'd argue it's the other way around. Go's culture of
avoiding dependencies meant that package management wasn't as big a
requirement as it is in other languages.

It'll be interesting to see if the average number of dependencies in a Go
project increases now that the package management system is more standardised
and powerful.

~~~
pornel
The article uses C tools as an example, and which are even more conservative
with dependencies than Go.

Note that it's the _transitive_ dependencies add up. Each project, even Rust,
or even npm, has only a few direct dependencies on average.

Actual stats for Rust crates:

    
    
         0 deps: 23.77% crates
         1 dep:  13.81% crates
         2 deps: 11.70% crates
         3 deps: 10.33% crates
         4 deps: 8.12% crates
         5 deps: 5.75% crates
         6 deps: 4.48% crates
         7 deps: 3.84% crates
         8 deps: 3.85% crates
         9 deps: 2.61% crates
        10 deps: 1.90% crates

~~~
marcus_holmes
interesting. I've no experience with Rust, so took his "2-300" at face value.

It'd be interesting to run the same analysis on Go projects and compare.

~~~
steveklabnik
It's not about "face value", it's that you may only have three dependencies,
but if one of those three has ten, and two of those ten have five, and so on
and so on. The article is talking about the end total, the parent commentor is
talking about direct dependencies.

~~~
marcus_holmes
Yeah, sorry, I meant that I misinterpreted his "2-300 dependencies per
project" to mean the developer themselves had included 2-300 dependencies per
project, rather than that was the final result of the entire dependency tree.

Maybe I've seen too many nightmare JS projects where this is literally true ;)

