Cargo
Rust's official build system and package manager.
HN commenters like Cargo for unifying Rust's build tooling12 and for easy dependency management that compares well with other languages' tools.345 The most common complaint is supply chain risk,67 since it lacks controls such as install-script allowlists8 and pushes users toward npm-like dependency sprawl.9
Why people recommend it
Easy dependencies · 3
Dependency management is seen as easy and better than older or rival package managers.
“lacking OOTB, common and easy dependency management like cargo”
Show 1 more
“I also like Cargo better than Nuget, but that's a very subjective opinion.”
Unified ecosystem · 3
One standard tool unifies the ecosystem and gives broad, well-built tooling.
“I love that cargo unifies the ecosystem, no quabble over one shitty build tool over another.”
“cargo as a tool beats any language tooling for any language with similar breadth”
Show 1 more
“In Iced you write in Rust and use Cargo packages. This gives the developer ultimate composability”
Workspaces · 1
Workspaces help split packages for build speed and versioning, with shared manifest settings.
“Cargo workspaces allow for sharing parts of the manifest through "workspace inheritance"”
Transparent supply chain · 1
One commenter argues its standardized, explicit dependency handling is more transparent than manual alternatives.
“How is your manual alternative to manage supply chain any better than this explicit one where transparency is standardised?”
Caveats and dissent
Supply chain security · 2
Commenters worry about supply chain attacks and missing controls like install-script allowlists.
“Cargo doesn’t have security controls in place to prevent these kinds of attacks”
“The cargo supply chain issues are also very obvious, I am far more worried about this than I ever will be about memory safety”
Dependency sprawl · 1
One former Rust user says it forces an npm-like experience with many immature, semi-abandoned crates.
“Cargo is a shitshow and Rust forces you into an npm-like experience”
Often compared with
Who recommends it in their own words
Threads where it came up
- The era of software quality, or the era of ostriches? 1 mention
- Rust is tier-1 language at Microsoft 1 mention
- Supply Chain Attack on Arrayref 1 mention
- Because It's Not Fun Enough: why languages fail 1 mention
- Show HN: Gitdot – a better GitHub. Open-source, anti-AI, and written in Rust 1 mention
- Why I'm Building a Database Engine in C# 1 mention
Data: cargo.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 13
“How is your manual alternative to manage supply chain any better than this explicit one where transparency is standardised?”
“Cargo is a shitshow and Rust forces you into an npm-like experience”
“Cargo doesn’t have security controls in place to prevent these kinds of attacks”
“cargo as a tool beats any language tooling for any language with similar breadth”
“lacking OOTB, common and easy dependency management like cargo”
“I also like Cargo better than Nuget, but that's a very subjective opinion.”
“I love that cargo unifies the ecosystem, no quabble over one shitty build tool over another.”
“I personally find cargo and the dependencies there to be roughly as ergonomic as python”
“Cargo workspaces allow for sharing parts of the manifest through "workspace inheritance"”
“I use cargo to manage the rust toolchain”
“The cargo supply chain issues are also very obvious, I am far more worried about this than I ever will be about memory safety”
“In Iced you write in Rust and use Cargo packages. This gives the developer ultimate composability”
“Cargo has really spoiled me.”