# crates.io

17 Hacker News commenters recommended crates.io and 18 criticized it, November 2025 to November 2026. It was recommended in 9 of 13 months.

**Verdict:** The main Rust package registry, free for developers and praised for its no-overwrite policy and easy access to crates. Critics warn of GitHub login dependence and supply-chain security risks.

## Why people recommend it

- Easy to find and import crates (4 comments): "I need a map of key ranges to values with intelligent range merging, it is right there on crates.io to import" ([source](https://news.ycombinator.com/item?id=46147528)) "crates.io provides solutions for many common problems already" ([source](https://news.ycombinator.com/item?id=46413677)) "crates.io makes it easy to use complex data structures" ([source](https://news.ycombinator.com/item?id=46621813))
- Team cares about security (2 comments): "The good news is the people behind crates.io and the Rust ecosystem care about security." ([source](https://news.ycombinator.com/item?id=47739041)) "They're definitely not unprepared for an incident like this." ([source](https://news.ycombinator.com/item?id=49376501))
- Free service that benefits developers (2 comments): "a small team of mostly volunteers offering a free service" ([source](https://news.ycombinator.com/item?id=47741344)) "Crate and npm are a boon for many developers." ([source](https://news.ycombinator.com/item?id=48086397))

## What people warn about

- Requires GitHub account to publish (4 comments): "crates.io, the main crate registry, uses GitHub as its only authentication method" ([source](https://news.ycombinator.com/item?id=46399823)) "A Github account is required to publish crates to crates.io (this sucks if you don't want to be locked in to another Microsoft system)." ([source](https://news.ycombinator.com/item?id=48546639)) "I hate how crates.io requires a GitHub account to publish anything." ([source](https://news.ycombinator.com/item?id=47498138))
- Typosquatting and malicious packages (3 comments): "Crates.io is an unmoderated wasteland of infinite transitive dependency chaos" ([source](https://news.ycombinator.com/item?id=45851507)) "crates.io is completely ripe for typosquatting and package overtakes" ([source](https://news.ycombinator.com/item?id=48198780)) "crates.io is a glaring security risk and a looming catastrophe" ([source](https://news.ycombinator.com/item?id=48575795))
- Slow to fix known issues (3 comments): "This isn't a particularly difficult problem, and other package ecosystems have solved it many times in the past." ([source](https://news.ycombinator.com/item?id=48669951)) "It was frustrating how long it took the Crates.io team (Rust manager) to address name squatting" ([source](https://news.ycombinator.com/item?id=48356843)) "They have known about the issue for a 10+ years and haven't fixed it yet" ([source](https://news.ycombinator.com/item?id=48546864))
- Weak moderation of published crates (2 comments): "Crates.io is an unmoderated wasteland of infinite transitive dependency chaos" ([source](https://news.ycombinator.com/item?id=45851507)) "I’m disappointed crates.io doesn’t have a stricter bar for serving a crate" ([source](https://news.ycombinator.com/item?id=49374737))

## Alternatives hackers recommend

- [Nixpkgs](https://hackerapproved.com/p/nixpkgs.md): 38 recommend
- [Arch User Repository](https://hackerapproved.com/p/arch-user-repository.md): 34 recommend
- [Arch User Repository](https://hackerapproved.com/p/aur.md): 20 recommend
- [PyPI](https://hackerapproved.com/p/pypi.md): 16 recommend
- [CPAN](https://hackerapproved.com/p/cpan.md): 13 recommend

## Cite as

Hacker Approved, "crates.io", https://hackerapproved.com/p/crates-io/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).