Rust Programmers Have Commitment Issues
A bit over a year ago, I finally found the time to learn Rust. I also had a great project that fit the language quite well: a Dalvik Executable parser. The project went well, and since it was when agentic programming was only starting to become useful, I still wrote it mostly by hand. Overall, the experience writing Rust was fine, a bit more verbose and manual since I was used to higher level languages, but for some things I could really see the benefit.
Fast-forward almost a year, and I had now stumbled upon the opportunity to write Rust professionally in my new day job. At work I was a bit skeptical, since Rust is still a sort-of new language, but I was assured that Rust is mature already and even large corporations use it widely. If it’s mature enough for FAANG, it’s surely mature enough for me1.
Fast-forward to today, and I feel like I’ve been lied to. Rust ecosystem is not what I thought. I’ve surrounded myself with zero-versioned dependencies with varying degrees of maintenance. As mainly a JavaScript programmer, I thought I’ve seen the worst of a programming language dependencies ecosystems, but actually comparing the two reveals a grim picture for Rust.
Note
While this post is a harsh critic on the Rust ecosystem, I have great respect for everyone who put their effort into open source. Nobody owes me (or anyone else) anything in open source.
The Zerover Disease
The most glaring issue was the crate versions. At the time of writing this blog post, our whole Cargo workspace contains 103 dependencies, 70 of them are at version zero. Recursively looking at the dependencies does not change the picture much. Out of a total of 1,090 dependencies, 756 of them are at version zero.
The first thought was that we might have made wrong choices. To have so many dependencies at version zero is to build on shaky ground. Sadly, I looked at the top 1,000 most recently downloaded crates from crates.io and the results were almost the same. Only 352 out of the top 1,000 crates had a stable version.
Looking at the number of zero-versioned crates was not looking good, but how is it compared to other languages? I checked npm’s most downloaded packages in March, and out of the top 1,000 packages, only 58 were at version zero. Rust is of course a much younger language, but such a difference, from a language that tries to look serious, was not looking good.
Abandoned Packages
As if versioning everything zero was not bad enough, a substantial chunk of them will probably never reach a stable version. Out of the 648 crates that are currently at version zero, 183 crates haven’t gotten a release for over a year (almost 30% of the zerover crates). For a stable versioned crate, I give the benefit of the doubt that it’s a finished crate that doesn’t need any more modifications, but that doesn’t work when the developers themselves don’t try to claim it.
Compared to JavaScript, percentage-wise, the situation is quite good, although only because there are so few zerover packages in general. In absolute numbers, npm only has 27 zerover packages that were not updated in the last year.
Watch Out For Buses
Another parameter that can show the health of an ecosystem is how many of the packages have a bus factor of one. Checking it is a bit harder, since GitHub does not let me see who has write access to the repository. Instead, I looked at the owners, looking for either a team owner or two or more owners listed. Out of the 1,000 crates that I’ve checked, 550 have more than one owner, not as bad as I first expected.
In this metric, Rust is also not that far behind JavaScript2, which has only 578 packages with more than one maintainer.
Looking Forward
I was not the first one to notice Rust’s ecosystem problems. There was already a blog post from 2020(!) about this exact problem. Sadly, it seems that we are still in the same problem. There are also people who, unlike me, actually try to tackle the problem, like with this closed issue.
I think it’s also important to put my personal experience into perspective. I assume that writing a SaaS product in Rust introduced me to a less mature ecosystem than if I had used Rust for system programming.