Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actix project postmortem

github.com

Post reply on HN
Print view View original

291–300 of 408 posts

Re: Actix project postmortem

#291

Post by smt88 »

kelnos wrote: post #281
Hello71 wrote: post #276

Earlier quoted context omitted.

This argument confuses and saddens me. If I give away free food which I and others know to be contaminated with foodborne pathogens, is it wrong for them to criticize it? What if I don't know, but I obtain it from a supplier which is known to persistently sell contaminated food? What if I put up a sign in very small print saying that the food comes with no warranty whatsoever and all consumers eat it at their own ris…

That is an entirely specious analogy. This code will not cause someone to get sick or die. And "contaminated" vs. "not contaminated" is a binary result for food -- one is the case and one is not the case. With code, there's nearly always room for reasonable disagreement as to what is the right/good or wrong/bad way to do things, and often people argue over two (or more) perfectly fine ways of doing things that just c…

I'm not sure if this will change your mind, but in the Rust world, there's a concept of "unsafe" code that can lead to vulnerabilities.

The difference here is that a code consumer can check a Rust project for unsafe code, whereas a food consumer cannot check for unsafe contaminants.

Re: Actix project postmortem

#292

Post by swsieber »

CDSlice wrote: post #186

For context, this comes after yet another unsoundness bug has been found in Actix-web. Normally people in the Rust community don't get very worked up over these because we know that everyone makes mistakes, but the Actix project has had a consistent history of introducing unsoundness through the use of unsafe for dubious reasons like nebulous performance increases or bypassing Rust's safety guarantees (which is what…

> This sort of behavior should not be acceptable from any open source maintainer that runs such a large, foundational part of the ecosystem.

And the better solution wouldn't be to harass the guy, but to recommend and try to move the ecosystem away from actix.

Re: Actix project postmortem

#293

Post by LoSboccacc »

Nullabillity wrote: post #261
z0mbie42 wrote: post #146

Earlier quoted context omitted.

The repo has not been deleted! https://github.com/fafhrd91/actix-web

From the bottom of the postmortem repo: > At the moment I am planing to make repos private and then delete them (will remove benchmarks as well), unless others suggest better ideas.

so it's not deleted. it's the last call for all the people that wanted to profit from his work to take up the mantle and drive the project

something anyone can do right now, I would add

but people just prefer directing the guy work

Re: Actix project postmortem

#294

Post by hobofan »

steveklabnik wrote: post #271
Traster wrote: post #264

Earlier quoted context omitted.

I've been thinking for a long time that one of the problems with these online shitstorms is that the adults in the room are silent. It would have been so much better if the senior people in the Rust community stepped in to actually say "Hey, we're all using it, yes it's got issues, but thanks for your contribution and don't worry about the idiots". Instead we've got senior people in the Rust community waiting until t…

It's a tricky balance. This is also sort of where I was getting at in my post with the "unofficial" bit; because /r/rust is not official, we do not look into it. And because this happened on Reddit, there was no real opportunity to actually step in. It's quite possible this is simply a failure on our part.

Today is the first time that I've heard that /r/rust is apparently regarded that little from the Rust team. To me it's the most important online gateway to the Rust community, and also the best resource to stay up to date with the ecosystem.

I knew that it was an "unofficial" channel, but given that it's most likely the single biggest aggregation of people in the Rust community, I always assumed that the Rust team would consider it of close to equal importance to users.rust-lang.org.

> And because this happened on Reddit, there was no real opportunity to actually step in. It's quite possible this is simply a failure on our part.

I don't think that much could've been done to prevent that. It also happened on such a quick timescale that one could've completely slept through the whole situation (from the initial Reddit comment to the post-mortem).

Re: Actix project postmortem

#295

Post by jmull »

saagarjha wrote: post #110
geofft wrote: post #99

Earlier quoted context omitted.

It's absolutely correct that people don't have obligations simply by putting some code online. But they do have obligations when they start telling people to use their code. We understand this as humans even in realms far from open source: if I see you approaching a door, I am under no obligation to open it just because I'm physically able to, but if I open a door for you, I'd better hold it until you're finished wal…

Well put. I’d add on to your metaphor: slamming the door on someone is quite different than just not holding it open anymore. The second is totally acceptable; the first is impolite.

This case is clearly akin to not holding the door open anymore.

The code’s all there and still available, right? Anyone who wants to can reach out and “hold the door open” for themselves, can’t they?

Re: Actix project postmortem

#296

Post by mythz »

bryanrasmussen wrote: post #273
rumanator wrote: post #263

Earlier quoted context omitted.

> I understand how he may he feeling, but this is probably the most used web framework for Rust. Not a problem. Just fork it and put in the work to maintain it. The license grants anyonr that right. What stops anyone from doing it? If that's too much to ask then perhaps it should put into perspective how project maintainers are abused.

Ok, but the arrow of time being what it is you cannot fork something usefully after all the code has been taken away. You can now fork the readme and change that. It's true I think everyone should do what I do which is to fork anything I think I might need at some point , but that isn't what you actually suggested and it isn't what the parent comment was observing could be a problem for people.

As stated clearly in the README:

> P.S. I moved actix-net and actix-web project to my personal github account.

So he's transferred it to:

https://github.com/fafhrd91/actix-web

Feel free to fork, take a copy, start a new repo. The project is dual Apache/MIT licensed so feel free to do whatever you want within its very liberal scope.

What you're not entitled to do is demand anything from the author or to take up any of his time. Take his code, but don't demand anything else from him.

> Nowadays supporting actix project is not fun, and be part of rust community is not fun as well.

> I am done with open source.

He's over the abuse and entitlement his received over the project and obviously doesn't want to spend any more of his time on it.

Re: Actix project postmortem

#297

Post by root_axis »

kelnos wrote: post #281
Hello71 wrote: post #276

Earlier quoted context omitted.

This argument confuses and saddens me. If I give away free food which I and others know to be contaminated with foodborne pathogens, is it wrong for them to criticize it? What if I don't know, but I obtain it from a supplier which is known to persistently sell contaminated food? What if I put up a sign in very small print saying that the food comes with no warranty whatsoever and all consumers eat it at their own ris…

That is an entirely specious analogy. This code will not cause someone to get sick or die. And "contaminated" vs. "not contaminated" is a binary result for food -- one is the case and one is not the case. With code, there's nearly always room for reasonable disagreement as to what is the right/good or wrong/bad way to do things, and often people argue over two (or more) perfectly fine ways of doing things that just c…

Indeed. Not to mention, embracing this analogy means literally all food is poison because every piece of software has critical security vulnerabilities whether they are widely known or as of yet discovered.

Re: Actix project postmortem

#298

Post by Fellshard »

Like it or not, it's best to view this incident as having direct parallels to the NPM left-pad incident.

Ignoring the specifics of what led up to this for the moment, observe that a single person was able to completely annihilate an entire dependency's source.

I think one of the primary requisites to reliable FOSS development and adoption will need to be tooling that maintains immutable records to the best of its ability, so that prior artifacts cannot be revoked; you publish code as FOSS, it is with the clear understanding that you have disposed of your authority to revoke it.

There are cases where something may need to be revoked, but make it a multi-layer process at that point, not a single button and one man's whim.

Re: Actix project postmortem

#299

Post by torstenvl »

kelnos wrote: post #281
Hello71 wrote: post #276

Earlier quoted context omitted.

This argument confuses and saddens me. If I give away free food which I and others know to be contaminated with foodborne pathogens, is it wrong for them to criticize it? What if I don't know, but I obtain it from a supplier which is known to persistently sell contaminated food? What if I put up a sign in very small print saying that the food comes with no warranty whatsoever and all consumers eat it at their own ris…

That is an entirely specious analogy. This code will not cause someone to get sick or die. And "contaminated" vs. "not contaminated" is a binary result for food -- one is the case and one is not the case. With code, there's nearly always room for reasonable disagreement as to what is the right/good or wrong/bad way to do things, and often people argue over two (or more) perfectly fine ways of doing things that just c…

Are you seriously claiming that food contamination is a "binary" thing? That it's impossible for food to be only a little contaminated, at a level that won't make you "get sick and die?"

Its common knowledge that a certain amount of food contamination is considered safe. And, although specifics are not generally common knowledge, it's easy enough to find that, e.g., the FDA views I don't think hyperbole is helpful to this conversation.

Re: Actix project postmortem

#300

Post by rossjudson »

CDSlice wrote: post #186

For context, this comes after yet another unsoundness bug has been found in Actix-web. Normally people in the Rust community don't get very worked up over these because we know that everyone makes mistakes, but the Actix project has had a consistent history of introducing unsoundness through the use of unsafe for dubious reasons like nebulous performance increases or bypassing Rust's safety guarantees (which is what…

You say, "This sort of behavior should not be acceptable from any open source maintainer that runs such a large, foundational part of the ecosystem."

Or what? What's the "punishment" here? Who's going to decide what's acceptable, and what's not?

Seems like you are demanding that the author of Actix do what you want.

Sometimes people take their football and go home. In this case the vocal complaining minority are free to make their own copy of the football, and proceed on their own...which is also known as "put up or shut up".

Post reply on HN