151–160 of 1001 posts
Earlier quoted context omitted.
I am not aware of anyone bringing legal liability into this situation, in any form.
I am replying to a comment citing legal liability language from a license?
It's almost instinctual/natural to misjudge the popularity of any project for some false sense of security or acceptance. Just think about the numerous issues that plagued the Node community around NPM packages with large amounts of downloads and GitHub stars that turned out to be problematic.
For me the deeper insight here is that we all sort of want our cake and eat it too. Project maintainers/owners want the freedom and enjoyment of working in open source building fun and useful things without any explicit commitments, and that's fair and understandable especially without any formal compensation. And the users want to be able to have access to a growing collection of projects without having much skin in the game, i.e. paying for it.
This isn't a problem with people, this is a problem innate to open source, and the double-edged sword that it is.
> “Why Reddit is like this” is a whole other essay; I think it’s built into reddit’s structure itself. Classic Eternal September. Around 60k subscribers, the cultural identity starts degrading, as the amount of "old guard" is outmatched by "new blood." Therefore, the old "monkey see, monkey do" phenomenon, where new users would slowly mimic the culture of the prevailing older users to "fit in," is replaced with new u…
Earlier quoted context omitted.
As someone who works for a dod contractor this whole situation sounds crazy. Just because something is available as a crate doesnt mean you are to assume it safe or appropriate for your use. The onus of verifying the dependencies should always be on the consumer.
Haha - also a dod contractor, and sometimes wonder whether I'm the insane one who can't handle the wild west behavior of HN people surrounding npm packages...
Earlier quoted context omitted.
As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.
That doesn't mean it's wrong to criticize his choices, so long as it's done without being insulting.
I feel like in any language, beginners are more than encourage to write things in said language. Yet when working on language internals, you need to be more careful. Reading the Firefox programming guide on what's allowed/not-allowed in the C/C++ codebase is pretty eye-opening[1]. Have there been issues with core Rust developers not being kind or following their CoC? The author doesn't really include examples or explore this line.
As far as Reddit: I stopped using it the moment one of their CEOs altered someone's comments during the election and was not asked to step down. That CEO is still there. Reddit had their warrant canary removed years before that. All their original values are pretty much gone and they've gone on a community banning spree over the past few years. It's also no longer open source. I'm fine with any community rejecting this as any kind of official communication platform, but no one is stopping enthusiasts or hobbyists from using /r/rust
If actix-web has unsafe code and the authors are not accepting patches, and someone feels passionately about it, they could create a saftix-web fork, include all the patches, and maybe even develop it independently or pull in changes from upstream.
It sounds like things went down terribly, and that's sad. Was it just Reddit people, or core devs? I agree it doesn't help to attribute blame, but the author doesn't dive into where the problem might have started and what could have been done differently. I wish this had some more explicit examples of how the community screwed up, the things they did right, the things that could have been better. But then again, that could lead to call-out culture BS. I feel this article is missing some depth, but it's also something that would have probably washed over without the author going out of the way to write this piece. I dunno. /shrug
[1]: https://firefox-source-docs.mozilla.org/tools/lint/coding-st...
Earlier quoted context omitted.
As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.
> As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you. Sure, but that DOES NOT mean you're immune to criticism, especially when it comes to security. Your type of argument could otherwise be used for pretty much everything - even large corporations. It's not useful.
No, if you pay for things, you have a contract and things are immediately different.
Earlier quoted context omitted.
As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.
> As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you. Sure, but that DOES NOT mean you're immune to criticism, especially when it comes to security. Your type of argument could otherwise be used for pretty much everything - even large corporations. It's not useful.
And you know what's a good form of criticism? An issue with an attached PR
A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this. I have two simple mantras which establish my philosophy here: 1. YOU are responsible for your dependencies. 2. Open source participants are volunteers and owe you nothing. It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change…
Exactly this. If it doesn't meet your standards, don't use it. Alternatively, go fork yourself.
I actually think the "code of conduct" culture that Rust embodies exacerbates this kind of drama. Ironically, it creates a more unsafe environment where everyone feels anxious and judged by the CoC Police. Under the CoC, I am entitled to a wonderful experience, and if I don't get it, the culture has failed in its commitment to me.
I have literally never felt "judged by the CoC police" in any project that has one. I have no idea why you would ever feel that way. Pretty much every CoC says "do not be a raging asshole". I am fully capable of not being a raging asshole, and if I slip up and am, I would be happy to be told off for it.