Hacker News new | past | comments | ask | show | jobs | submit login

>If we're going to be trusting some random guy's binaries, I think we are in the right to demand that it is byte-for-byte reproducible on commodity hardware without having to reverse-engineer the build process and figure out which nightly version of the compiler is being used to compile this binary blob that will be run everywhere.

David Tolnay is not a random guy.




Then extrapolate "random guy trying to follow dtolnay's lead."


Well then complain about that, not this.

And anyway it doesn't really matter. As soon as you use anyone's crates you're more or less completely trusting them. It's not difficult to hide malware in a Rust crate even if you don't ship a binary.

And... come on. David Tolnay came up with Watt. He's clearly not intending to ship a binary forever - the long term solution is WASM.

This author comes across as an annoying naysayer - everything is impossible, even things that have already been done like WASI.


wasm is also a binary format, and I wouldn't like it to be included into the .crate file either. The .crate files should ideally only include source code, to preserve the source first nature of crates.io (even if it's never been officially confirmed).

Rustdoc is also automatically built by docs.rs and nobody distributes it in their .crate file. I think the same should be done for wasm proc macros, too: they should be built by public infrastructure, and then people can opt into using binaries provided by that infrastructure to do their development, and if they want also opt towards using native binaries instead of wasm. But the binaries, including wasm, should only be a cache.


> I think the same should be done for wasm proc macros, too: they should be built by public infrastructure, and then people can opt into using binaries provided by that infrastructure to do their development

That's obviously how it would work. Read dtonlay's proposal. Crates.io would compile the WASM.


Only as a verification step though, not to obtain the actual binary, which will be included in the .crate package, where it IMO should not be put.


/shrug He is to me.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: