Rust In Enterprise
Tags: Rustlang, Rust, Discord, Programming, Microsoft

Rust In npm, Inc.

As npm grows, it’s engineering team is keenly aware of software that may become a performance issue. Rust’s utility in this space is well documented in the Rust npm Whitepaper.

For most npm operations ( those that are I/O bound ), JavaScript has been a sufficient solution. However, some operations — namely, an authorization service — presented CPU-Bound problems that would fail to maintain performance constraints at scale. In rewriting the legacy Node.js implementation of this service, the npm team considered a number of technologies:

C and C++ were quickly rejected:

“I wouldn’t trust myself to write a C++ HTTP application and expose it to the web” — Chris Dickinson, an engineer at npm. “A C or C++ solution is no longer a reasonable choice in the minds of the npm engineering team. These languages require expertise in memory management to avoid making mistakes that cause catastrophic problems. Security problems, crashes, and memory leaks were not problems that npm was willing to tolerate in order to get improved performance.” — npm Whitepaper

Java also fell short:

“Java was excluded from consideration because of the requirement of deploying the JVM and associated libraries along with any program to their production servers. This was an amount of operational complexity and resource overhead that was as undesirable as the unsafety of C or C++” — npm Whitepaper

The languages that met the criteria outlined by npm were Go and Rust. npm opted for an objective test by rewriting the system in both languages, as well as in Node.js to serve as a baseline.

Go came close:

Go was memory safe, easily deployable, and faster than JavaScript, but it isn’t much of a surprise that npm — a company that offers the world’s largest software registry — was particularly disappointed with Go’s lack of an official dependency management solution ( this was before Go Modules ).

“The prospect of installing dependencies globally and sharing versions across any Go project (the standard in Go at the time they performed this evaluation) was unappealing.” — npm Whitepaper

On the other hand, the team was enamored with Cargo, Rust’s dependency manager, which took inspiration from npm.

Rust:

Compared to Go and Node.js, there was a slowdown in development speed, largely stemming from Rust’s learning curve. The rewrite in Rust took a week, while the rewrite in Go and Node.js took two days and an hour respectively. However, npm credited Rust’s community for making the process easier through “inclusivity, friendliness, and a solid process for making difficult technical decisions.”

On the other hand, Rust boasted a major advantage in terms of time spent solving runtime errors:

“My biggest compliment to Rust is that it’s boring, and this is an amazing compliment.” — Dickinson “npm’s first Rust program hasn’t caused any alerts in its year and a half in production. At npm, the usual experience of deploying a JavaScript service to production was that the service would need extensive monitoring for errors and excessive resource usage necessitating debugging and restarts.” — npm Whitepaper

In the end, npm chose Rust, noting it’s straight forward deployment, dependency management, and few operational issues as causative factors. For npm, it appears that the time and resources saved in debugging and monitoring was worth the extra time devoted to learning the language in comparison to Go.