Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actix project postmortem

github.com

Post reply on HN
Print view View original

191–200 of 408 posts

Re: Actix project postmortem

#191

Post by logophobia »

beatgammit wrote: post #136
logophobia wrote: post #31

Earlier quoted context omitted.

It's not coding style, it's refusing to investigate use-after-free vulnerabilities in code because it's "boring". Noone should care if a maintainer uses tabs or spaces, or has weird variable naming, but if "coding-style" leads to security issues (due to hand-rolling unsafe memory-primitives), then it is an actual issue, especially if it's for a popular web-framework. Don't like it, don't use it doesn't really apply t…

> somewhat self-inflicted Let's not start victim-blaming please. Yes, the maintainer could have made his reasons for making the project more clear, and the maintainer could have been more clear on the intended use of the project (not for production, personal project to see how fast Rust can be, etc). There are a lot of things the maintainer could have done. However, that doesn't mean there wasn't a problem. There was…

> However, that doesn't mean there wasn't a problem. There was a ton of negativity around "unsafe" when the author first released the code, and it has kind of become a meme at this point. If a project consistently uses code in an unsafe way, is it really worth spending your time vetting it for your production use case? There are plenty of web severs out there, pick one that aligns with your goals.

Should people wait until credit-card data or PII is leaked due to security vulnerabilities? The problem with security is that it impacts more than just the programmers using the framework, it impacts everyone. Does the author deserve the nastiness? No. Do security issues need to be reported, and if not fixed, called out? Yes, for big and advertised projects issues like that need to be reported. If not, there will be users that would naively expect the web-framework they're using to be somewhat secure.

The framework had a professional looking website advertising the project, it had good documentation, a user-friendly API. It advertised a actix open-source community. Had over a million downloads. I would say that expecting actix to be run like a somewhat professional project is not a strange assumption.

The way it was called out was pretty terrible though, and I doubt anyone is happy with what happened.

Re: Actix project postmortem

#192

Post by The_rationalist »

saagarjha wrote: post #126
m4r35n357 wrote: post #42

I don't get it. This is a Git project. So did none of these people actually bother to clone it? Probably easier to just rely on binaries . . . suckers!

One of the downsides to GitHub is that it stores a lot of state that Git cannot capture, and is at the mercy of project maintainers to continue existing unaltered.

But forks prevent that, right?

Re: Actix project postmortem

#193

Post by toyg »

setr wrote: post #187
toyg wrote: post #150

Earlier quoted context omitted.

But you don't hold a door: you are dropping a package on the street and letting people pick it up. Anyone can reuse the cardboard, paint it red, stack it up with other packages, or hang it on their livingroom walls... but there is no guarantee that the package won't contain a bomb, that the cardboard was made by eco-friendly methods, or that it will last one second after getting dropped on the streets.

That's the bare minimum of what you can do, which really just constitutes dumping your code on GitHub, slapping an unmaintained label in the readme, and calling it a day But we can go beyond that, and start to do more work, and make grander social promises. Calls for a "community" come with the implicit agreement that this codebase now exists for more than just the one person who initialized it. And that you've pushe…

Lawsuits is how society distinguishes the actual social contract from wishful thinking. You are free to establish your own imaginary community based on imaginary rules of etiquette, but everyone else is free to ignore such "rules".

Re: Actix project postmortem

#194

Post by geofft »

dangerface wrote: post #159
saagarjha wrote: post #135

Earlier quoted context omitted.

We’re starting to stretch the metaphor too far, but by opening the door you’ve signaled to me that I can walk through it safely. Closing it abruptly can in some cases be even worse than the alternative, since I could have possibly opened the door myself (written it myself and not invested time in this particular project) or gone through a another door that was also being held open (used another open source project).

> by opening the door you’ve signaled to me that I can walk through it safely. It was safe for me, is it safe for them? Thats not a judgment I can make on their behalf. A lot of people are complaining that the code is unsafe while the author thought it was safe enough for them. How many nines is safe, depends on the person. You should consider these things before using some ones help, not after, looking at the commen…

> A lot of people are complaining that the code is unsafe while the author thought it was safe enough for them. How many nines is safe, depends on the person.

There's a very precise definition of this, it's not a matter of opinion. The code exposed a public API that was not marked "unsafe" that allowed you to construct (definitely intentionally, perhaps unintentionally) two mutable references to the same object.

> So this guy is happy to rely on code he hasn't even looked at and then gets upset when that code is unreliable. This is not a reasonable expectation.

This is a hostile misinterpretation of what actually happened. The bug reporter actually looked at the code, determined it was unsafe, and reported a bug. That's what everyone wants an OSS user to do.

Re: Actix project postmortem

#195

Post by brobdingnagians »

Closed source is more fun to develop. You get full control over your code, you just have to meet the needs of people who think it is worth enough to pay for it, you can code in whatever eccentric manner you want, and you get to keep the nice wads of cash if it becomes successful. If security is a problem, then the people with wads of cash will leave, but at least there is some incentive there.

Re: Actix project postmortem

#196

Post by lidHanteyk »

Dowwie wrote: post #171

I've been using actix-web for my work for some time, contributing however I can while learning Rust and myriad other subjects. This was the third major public event involving controversial design and implementation decisions. A great number of people in the Rust community have refused to accept that not everyone subscribes to their ideology about use of unsafe. They've repeatedly tried to impose their values and prio…

I wonder to what degree the entire incident happened because Rust has unsafe-blocks.

Re: Actix project postmortem

#197

Post by teddyh »

telmo wrote: post #88
teddyh wrote: post #23

Earlier quoted context omitted.

> These kind of entitled attitude If you offer code to the public – and present it as an active, dependable project – professional behavior is exactly what you implicitly promise and signed up for . If you can’t offer that (at any time, and for any reason), then you should immediately make that clear, front-and-center, to any current and future users. It isn’t “entitlement” on part of the users – the users are making…

> If you offer code to the public – and present it as an active, dependable project – professional behavior is exactly what you implicitly promise and signed up for. If you can’t offer that (at any time, and for any reason), then you should immediately make that clear, front-and-center, to any current and future users. As far as I can tell, this project was released under the Apache License 2.0. https://github.com/ac…

> Other popular free software licenses (namely the GLP) have very similar clauses.

What the license says and what image the project presents can be very different. Pointing to the license and reasoning that nobody has legally promised anything contractually is not very useful.

> Expecting labour from someone without paying them is the very definition of entitlement.

That’s a very mercenary view of the world. What about volunteer charity workers? Is it OK for them to just not show up whenever, just because they aren’t paid?

Re: Actix project postmortem

#198

Post by moralestapia »

stavros wrote: post #35

Whatever drawbacks Actix may have had, this entitlement has gone too far. There is no defensible reason to tell someone "never write Rust again" because you don't like the code they're making available to you. We need something to remind us that we should be civil and grateful for FOSS contributions. I recently saw a talk by Atwood about good discourse and how you should remind people of your values before they write…

>I recently saw a talk by Atwood ...

Interesting, if you could share a link or some other source me and my dinner would appreciate it :)

Re: Actix project postmortem

#199

Post by toyg »

lifthrasiir wrote: post #174
toyg wrote: post #160

Earlier quoted context omitted.

Nah, it's just the usual delusion of small-but-growing communities. The Python community was great in 2001, a bit less so these days. The Lisp community was probably great at some point in the '70s too. It's just that, with size, the likelihood of attracting undesirable elements inevitably grows until their presence simply cannot be denied. At that point, you either deploy heavy-handed moderation and get branded "unw…

Of course I don't disagree to you, I too think that that reputation is extremely hard to retain. However: 1. It seems that there are/were some language communities noted for their relatively more welcoming atmosphere. If small communities are usually great until it aren't, why don't we see many such communities? There seems to be some truth in this (albeit ultimately fragile) reputation. 2. For this reason, in order…

If a small community is great and the tool they push is valid, it will grow until it's not great anymore. Try mentioning any tool that has grown in popularity, stood the test of time, and still has an exemplary community.

If a small community is great but the tool is not particularly good, they will stay small and simply get ignored. That's the average scenario for most languages not pushed by a wealthy vendor: you just don't hear about them because you don't need the tool.

> you need multiple anecdotes at the very least.

Meh, this is just the first of many to come, if Rust is to keep growing in popularity. It's on the same trajectory as Go, just a bit behind because it got usable a few years later.

Re: Actix project postmortem

#200

Post by nipinium »

janoc wrote: post #185
walki wrote: post #30

Earlier quoted context omitted.

I absolutely agree with this. The author has spent an insane amount of time to build all this stuff and instead of getting recognition and/or being payed adequately he is getting shitstorm after shitstrom. As an outsider I have to say that I think what the Rust community has technically achieved is remarkable. But on the social side it is not so bright, avid Rust users constantly spam forums of other programming lang…

Well, no different than any other tech where the community is an echo chamber full of fanboys. Linux used to be like that, especially some of its distros (uhm Gentoo?), cryptocurrency fans are like that, Apple users probably don't need mentioning neither ...

Gentoo is just a meme spread by some 4chan /g/ board's members. Maybe you meant Arch?
Post reply on HN