[dystroy]

Having vetted repositories of libraries looks neat but it's harder in practice than what the article lets appear.

A problem for such repositories like the Debian one is that it can only contain vetted versions of libraries. Many Rust libraries are still 0.x and have changing API and frequent updates, which makes it hard to vet all dependencies, especially when an update implies updates of the dependents.

[mborch]

Perhaps this should be an incentive for library authors to finalize the 1.0 API and accept that there's eventually going to be a 2.x down the road, a "less is more" approach.