urllib3 VS mrustc

As opposed to what the article says, urllib3 now has experimental support for browser as of Jan 30th.

Source: https://github.com/urllib3/urllib3/releases/tag/2.2.0

Then, I tried to get a firm grip on urllib3 base code, contributing this and there until I was ready to kick things up with a proof of concept that would have put urllib3 far ahead. Without any breaking changes. I was delusional. This was a bit of a shock, but six months passed between my initial kick off and my formal give up, and here's why in a nutshell:

Oh wow, thanks for this story! Would love to hear more if you have time :) Good luck with testing it out.

Note that we found an issue w/ emitting an InsecureRequestWarning by default. The request is perfectly secure, it's just we aren't telling the ConnectionPool that information (see: https://github.com/urllib3/urllib3/issues/3331)

I've had a good experience doing a couple of bug fix bounties for urllib3 https://github.com/urllib3/urllib3/issues . I'd be interested in how the maintainers how found running the bug bounty and if it's given them more useful fixes or if it just adds more noise to deal with

ImportError: urllib3 v2.0 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with LibreSSL 2.8.3. See: https://github.com/urllib3/urllib3/issues/2168

> Could not import extension sphinx.builders.linkcheck (exception: urllib3 v2.0 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with OpenSSL 1.0.2n 7 Dec 2017. See: https://github.com/urllib3/urllib3/issues/2168)

This error is coming from Python, it's telling us Python is failing to import the urllib3 library, these lines here are important:

Requests allows you to send HTTP/1.1 requests extremely easily. There’s no need to manually add query strings to your URLs, or to form-encode your POST data. Keep-alive and HTTP connection pooling are 100% automatic, thanks to urllib3.

Judging projects based on stars is really immature. for example everyone knows requests https://github.com/psf/requests the python package that is used in every python project out there. it has 47k star too WOW. but the thing that less people know is urllib3. https://github.com/urllib3/urllib3. it has only 3k stars. It basically does the heavy lifting for requests!!

urllib3 – Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more

No, you don't. Existential proof: mrustc ignores lifetimes. Just flat out simply ignores. It changes some corner-cases related to HRBT, yet rustc compiled by mrustc works (that's BTW mrustc exist: to bootsrap the rustc compiler).

Incidentally C++ is the only way to bootstrap rust without rust today.

https://github.com/thepowersgang/mrustc

Well, there is mrustc[0], a Rust compiler that doesn't include a borrow-checker, so it's possible to compile (at least some versions of) Rust without a borrow checker, though it might not result in the most optimized code.

AFAIK there are some optimization like the infamous `noalias` optimization (which took several tries to get turned on[1]) that uses information established during borrow checking.

I'm also not sure what the relation with NLL (non-lexical lifetimes) is, where I would assume you would need at least a primitive borrow-checker to establish some information that the backend might be interested in. Then again, mrustc compiles Rust versions that have NLL features without a borrow-checker, so it's again probably more on the optimization side than being essential.

[0]: https://github.com/thepowersgang/mrustc

[1]: https://stackoverflow.com/a/57259339

> Maybe another memory safe language, but Rust has severe bootstrapping issues which is a hard sell for distros that care about source to binary transparency.

It is possible to bootstrap rustc from just GCC relatively easily, although it's a little bit time consuming.

You can use mrustc to bootstrap Rust 1.54: https://github.com/thepowersgang/mrustc

And from then you can go through each version all the way to the current 1.72. (Each new Rust version officially needs the previous one to compile.)

Have you tried this route : https://github.com/thepowersgang/mrustc ?

Mrustc supports Rust 1.54.0 today

There are three. The official one, mrustc (no borrow checker, but can essentially compile the official rustc) and GCC (can't really compile anything substantial yet). Only rustc is production-ready though.

That probably depends on what you mean by problematic. Having an ever increasing chain of dependencies isn’t the most desirable situation so there has been some work to trim the bootstrap chain. In 2018, when the blogpost I linked above was written, mrustc was used to bootstrap rust 1.19.0; now mrustc can bootstrap rust 1.54.0 so the chain to recent versions is much shorter than if all those intervening versions back through 1.19.0 needed to be built. https://github.com/thepowersgang/mrustc