121–130 of 1001 posts
Earlier quoted context omitted.
It got moved to their personal github account, not deleted.
He said he is going to move it to private in his [post mortem]( https://github.com/actix/actix-web )
> “Why Reddit is like this” is a whole other essay; I think it’s built into reddit’s structure itself. Classic Eternal September. Around 60k subscribers, the cultural identity starts degrading, as the amount of "old guard" is outmatched by "new blood." Therefore, the old "monkey see, monkey do" phenomenon, where new users would slowly mimic the culture of the prevailing older users to "fit in," is replaced with new u…
A community grows and eventually reaches the point where users cannot recognize who they're interacting with nearly every time, where the submission queue is trailing down too fast for any single reader to process. When that happens, it can no longer function as a cohesive community. It becomes about as personal as a magazine about the very same topic. Furthermore, the incentives to post change due to the higher pote…
Armchair psychology? No, I've made many friends and acquaintances, both online and in real life. The ones that bubble around posting online heavily, have developed antisocial tendencies that were reinforced through social exclusion. A self-fulfilling prophecy. I know this, because I know those people well and because I was there at one point in my life as well.
Neither is it condescension. Perhaps I may have been in-exact and may have offended some that do post online very regularly, but there must be a distinction between what they consider "regularly" and what I consider "heavily." Heavily, in my observation, is someone that puts aside a significant amount of time, usually involuntarily, to do nothing but interact with online communities for the sole purpose of social interaction. No value judgements were made either, but those characteristics are common among the aforementioned group.
I won't address your hypothesis, because I'm not here to argue.
Rust is a macrocosm of a phenomenon I've noticed in my own career: My productivity is inversely proportional to how dogmatically "correct" I'm trying to be with my implementation. The Rust community embodies many of the negative aspects of perfectionism that tend to stall real world progress. That perfectionism doesn't necessarily carry over to your code, but I find myself wondering if I'm doing things "the right way" far more in Rust than other languages.
Some growing pains are normal for any community. I really hope the Rust community can settle into a healthy environment. Until then, I'll reserve Rust for only smaller projects where I can afford to bail and rewrite in another language if it starts to spiral in complexity.
A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this. I have two simple mantras which establish my philosophy here: 1. YOU are responsible for your dependencies. 2. Open source participants are volunteers and owe you nothing. It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change…
The problem was that PRs which would have fixed security issues where not accpeted.
Do I expected perfect code from maintainers or a answer the next day? No, never
Do I think maintainers/creators should merge prs in a timely manner, or ask for help if it get's too much? Yes, otherwise you have multiple forks and the project is not usable anymore.
Question: why didn’t the more safety-focused developers just fork the project? I feel like fork-o-phobia causes 90% of the incidents like this.
Forking is extremely aggressive, and just because someone has the time to write a patch doesn't mean they have the desire or time to run a project.
But… are there ways forking could be made less aggressive (perhaps easy re-joining, community-based PR review and testing)? I remember this was a huge deal in the NodeJS community a few years back—it took a hostile fork to get the conservatives and progressives to agree on a way forward together.
> “Why Reddit is like this” is a whole other essay; I think it’s built into reddit’s structure itself. Classic Eternal September. Around 60k subscribers, the cultural identity starts degrading, as the amount of "old guard" is outmatched by "new blood." Therefore, the old "monkey see, monkey do" phenomenon, where new users would slowly mimic the culture of the prevailing older users to "fit in," is replaced with new u…
> Generally, the type of person to post on Reddit frequently enough, has social cohesion problems that may preclude him from fulfilling his social needs through more healthy avenues, like real life. You mean like making sweeping generalisations about a platform with millions of users?
I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project. No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Of course, you could…
How about instead of pushing the responsibility on someone else, you take responsibility for YOUR security-sensitive context and do the research before you start installing libraries?
This article is someone who did that research on multiple Rust HTTP clients and reported what they found:
https://medium.com/@shnatsel/smoke-testing-rust-http-clients...
Which I believe is what kicked off the events leading to Klabnik's blog post?
Here's the reddit thread in question: https://www.reddit.com/r/rust/comments/epoloy/ive_smoketeste... I have no doubt it led to some github issue brigading, but it's not really that big of a deal. Ostracizing /r/rust in a mealy mouthed way probably won't make that community better...
Yeah, I agree. “It’s all reddit’s fault” is not helpful at all and simply wrong from reading that thread.
Earlier quoted context omitted.
> It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change anything in the slightest. I don't think the anger is directed at there being security issues, the anger is directed at the fact that even when security vulnerabilities where found and patched, there was major pushback even getting those patches merged into the library.…
As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.
Earlier quoted context omitted.
> No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. It's not like he was getting paid to work on this, was it? And people do have a life beyond open source. People could have forked and worked on the issues themselves, but that's asking too much. Why do the hard work when you can just write a comment/tweet blaming someone else, right? Your comment is precisely what…
I don’t have the full picture here, but the source article implies that folks weren’t just complaining, but also offering PRs to fix the issues, which were rejected. That feels less like entitlement to me and more like bad stewardship of the project, but again, most of my info is biased by source article.
At some point, a flood of poor PRs can be worse than a flood of angry bug reports. The cost of validating and cleaning up a PR is significantly higher than closing a bug.