I wrote my Master's thesis about Rust and found some interesting things about the Rust ecosystem
Hi fellow rustaceans!
This spring I wrote my Master's thesis to get my degree in electrical engineering at LTH, and I decided to combine my love for FOSS and Rust!
The tool I wrote, cargo-indicate, accepts GraphQL, and is able to recursively search dependency trees for unsafe usage, GitHub stars, crates.io downloads and much more! This is possible thanks to the Trustfall query engine, and tools like cargo-geiger and many others, so a big shout-out to the people behind these tools! The tool I wrote itself is available under a dual MIT/Apache-2.0 license.
Some of the more interesting findings (in addition to the tool itself) are:
- When comparing all analyzed packages, the ones to stick out the most are... Windows API bindings. Because of course they are.
- The amount of GitHub stars projects have a (log-)bimodal distribution, indicating that there are more than one thing affecting project popularity (most likely marketing^see: ^this ^post)
- A large amount of advisories might be a good thing for your dependencies. Only a small subset of developers reports advisories (at least to the RustSec database), so those writing reports might actually care a lot about the project
My thesis includes a lot of graphs if anyone want to deep dive into distributions of different metrics!
Here are some links if anyone is interested:
The thesis itself, published by Lund University
A medium article I wrote, summarizing my tool and some interesting findings
Populärvetenskaplig sammanfattning for the Swedish speakers out there :)
A big thanks to Volvo Cars for sponsoring my thesis!
If anyone has any questions I am more than happy answer!