161–170 of 1001 posts
Earlier quoted context omitted.
As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.
That doesn't mean it's wrong to criticize his choices, so long as it's done without being insulting.
Earlier quoted context omitted.
In that case, you clone and fork. If you're just trying to get your stuff working, your fork is private. If instead you're trying to enjoy publicity, you publicize your fork. In neither case is it necessary to annoy someone who has already done a lot of free work for you.
Reporting bugs is annoying? I want people to point out bugs in my code, so both my code and me as a developer can improve.
And, anyway, yes, reporting bugs can be extremely annoying. Different devs respond to this annoyance differently. npm devs, for example, have decided not to pay too much attention to bugs reported by the public. [0]
Earlier quoted context omitted.
As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.
> As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you. Sure, but that DOES NOT mean you're immune to criticism, especially when it comes to security. Your type of argument could otherwise be used for pretty much everything - even large corporations. It's not useful.
if you accept that the open source projects are voluntary as an axiom then you in fact cannot criticize choices made by the volunteer.
here's an analogy: a homeless person asks for money. you don't give him money but buy him food. can the homeless person rightfully criticize you?
The Rust community is very, very toxic. They fight internally, but externally, they take over any thread about anything and make it about Rust.
The redditards are basically the task force that things Rust is the greatest thing since sliced bread
Earlier quoted context omitted.
I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILIT…
IANAL but I'm fairly certain this protects you against legal action and not negativity on the internet. Furthermore, if we're to interpret this clause as "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.
"If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project."
The reply:
"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ... FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT."
Furthermore, from the GP: "No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them."
Nothing in the license implies any such guarantee.
> "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.
I mean, that's what the license says. If you want assurances, get it in writing. Otherwise, when you use code, it's on you to make that guarantee of the code you are using.
Entitlement. Gimme gimme gimme. It's a shame.
A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this. I have two simple mantras which establish my philosophy here: 1. YOU are responsible for your dependencies. 2. Open source participants are volunteers and owe you nothing. It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change…
If you as a user don't like it, ask for a refund.
To start: any personal attacks against the author are unacceptable. Anyone is free to write whatever the code in Rust they like, and it is wrong to attack them about it. But .... I think it is showing that the premise of memory safety in Rust is working. Stuff that would go unnoticed in C and C++, is being identified and called out in Rust. Does it lead to drama, personal conflicts, etc.? Maybe. But from the perspect…
Let's take an extreme example: I write some program for common use and intentionally introduce a security hole or make it participate in bot-nets. And don't tell anyone about it. Am I "free to write it because I like it"? Well, in some sense, maybe, but it would also be something extremely problematic for me to do. Certainly everyone would scream bloody murder when it gets found out.
So, in a less extreme example, there's still some measure of responsibility of mapping out what and how you've vetted, and not making false claims.
Earlier quoted context omitted.
> It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change anything in the slightest. I don't think the anger is directed at there being security issues, the anger is directed at the fact that even when security vulnerabilities where found and patched, there was major pushback even getting those patches merged into the library.…
The community's response might be valid if it were limited to that. But, quoting TFA, they went beyond that. "It’s extra nasty this time. Some people go far, far, far over the line." When someone polite says this, I picture some of the nastier attacks on the internet - doxxing, death threats, and swatting.
Earlier quoted context omitted.
It got moved to their personal github account, not deleted.
He said he is going to move it to private in his [post mortem]( https://github.com/actix/actix-web )
"(Btw thanks to everyone who provided prs and other help!)"
So the maintainer was grateful for the PRs, but worn down by all the people complaining without contributing.