Because the memory safety Rust offers isn't worth the supply chain risks: https://safeguard.sh/resources/blog/rust-supply-chain-securi...
replyA problem that C solves by simply not having a supply chain! You can vendor dependencies in Rust just as easily as you can in C; far easier in fact thanks to `cargo vendor`. Cargo won't review them for vulnerabilities though, you'll still have to do that yourself.
replyIt does, the package systems of C evolved alongside the OS, so they are now the OS package managers and also cope with all other language mangers.
replyC (and C++) has a supply chain. It's called unpaid Linux maintainers.
replyDon't use packages you didn't vibecode and audit yourself then. That's the situation C puts you in anyway.
replyThe Rust ecosystem isn't structured for the high friction dependency model the C has. Its structured around nearly frictionless dependencies so its no surprise that dependency trees are very large and frequently changing.
replyThe typical C project has far fewer dependencies than the typical Rust project. Those dependencies are usually individually larger and either maintained by OS maintainers or there is a copy of the code that is built for the project and is readily available for audit. Those copies can't change without direct action.
Its less trouble to setup static analysis, address sanitizer, and similar tools for a C project than it would be to manage local copies of thousands of dependencies for a Rust project.
deleted
replysupply chain, compile times, binary size
replyNot huge problems for a web app, where you are controlling deployment yourself.
reply