A Sad Day for Rust • Hacker News Board

Re: A Sad Day for Rust

#211

Post by velcrovan » Fri, Jan 17, 2020, 4:10 PM UTC

vunie wrote: post #6

I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project. No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Of course, you could…

Backing up another level...it’s concerning to me when a language relies heavily on single-maintainer libraries for commonly needed functionality.

If actix-web was this important, it should have been adopted by the community before now. Maybe languages need a way of setting the expectation to that if your library becomes essential to the community (and if licensing allows) the core developers are going to fork it and find a way to govern/maintain it the same way they maintain the rest of the project.

I think about this a lot with Racket lately. Some of the core packages that everyone uses for date/time, Markdown parsing, etc., were written by a single guy in his spare time, who a few months ago was making noises about quitting the language (so far so good though).

Re: A Sad Day for Rust

#212

Post by jeltz » Fri, Jan 17, 2020, 4:10 PM UTC

coldpie wrote: post #43

ridaj wrote: post #4

It brings up the question — as a developer, how can you best set boundaries on your customers so that you can have some degree of control over the toxicity of the culture that you're exposed to when interacting with them?

It's a good question. I'm involved in a large open source project that attracts some of this kind of attention. Because of the project's age, much of our infrastructure is old, which actually sort-of works to our advantage here. If you want to be a jerk to us, you need to go find our mailing lists and figure out how to send an email, or register a Bugzilla account and go file some troll bug. Much more effort than pos…

Hm, dunno, I am tangentially involved in a big open source project which almost never gets any negative comments, neither on Reddit nor here and the feedback is usually useful. Yes, the project uses mailing lists for the development, but there is almost no negativity in other parts of the community.

I have no idea why some projects gets toxic attackers while others are almost entirely spared. One thing which the project prioritizes is taking the time to explain to people why their ideas which look good on paper may actually be missguided.

Re: A Sad Day for Rust

#213

Post by deng » Fri, Jan 17, 2020, 4:10 PM UTC

makomk wrote: post #176

deng wrote: post #157

Earlier quoted context omitted.

> Your type of argument could otherwise be used for pretty much everything - even large corporations. It's not useful. No, if you pay for things, you have a contract and things are immediately different.

So basically, if you use open source code in your code, you should expect there to be security vulnerabilities which people know about and are keeping quiet about because it'd be unfair to the unpaid creator to criticise them? Tbat sure makes it sound like it's morally irresponsible to use open-source rather than purchased commercial code in something like a web-facing service in 2020, especially given what we know n…

Please don't twist my words. I never said you have to keep quiet or that you're not allowed to criticize. If you see that a project has serious issues, feel free to write a blog post about it. Maybe offer to help, but don't demand your help being accepted.

Re: A Sad Day for Rust

#214

Post by fapjacks » Fri, Jan 17, 2020, 4:10 PM UTC

Man... Wouldn't it be great if this same attitude often seen in users of open source software was had by regular people toward civil liberties? Like where people just pile hate on the codifiers day in and day out, because they are owed their entitlements by birthright.

Re: A Sad Day for Rust

#215

Post by cesarb » Fri, Jan 17, 2020, 4:11 PM UTC

fortran77 wrote: post #185

tasogare wrote: post #135

Earlier quoted context omitted.

Was here to post something along this line. The only place in which I'm (hopefully) in contact with the Rust community is here. What do I see all the time? - "rewrite it in Rust" kind of posts on a lot of threads - upvoting Rust mildly or not interesting projects just because there are written in Rust - down voting every comment that even slightly criticize Rust (this comment will be gray when you'll read it) or remi…

I am _very_ productive in GC languages. I use F# and C# all the time, and the code runs fast, everywhere. And I don't have to worry about memory, and don't have to learn a wacky syntax and wait for hours for a "borrow checker" to complete its static analysis.

> and wait for hours for a "borrow checker" to complete its static analysis.

The borrow checker is actually fast, the part where you wait for hours is the code generation. There is nowadays also a "cargo check" command which stops before the code generation, which you can use when you want only to see if it would compile without errors (without waiting for it to actually compile).

Re: A Sad Day for Rust

#216

Post by jimbokun » Fri, Jan 17, 2020, 4:11 PM UTC

steveklabnik wrote: post #139

jimbokun wrote: post #108

Earlier quoted context omitted.

All of this is second hand, where are the mean comments "making" this person quit their own project? Were they actual personal attacks, or just criticism of the code? If you can't accept legitimate criticism of your work, that shows a real lack of maturity. (The article didn't give concrete examples, so I don't know which is the case here.)

Here is an example of an actual comment. I believe the thread is deleted now: > "seriously? Please just stop writing Rust. You do not respect semver, you do not respect soundness, so why are you using a language predominantly based around doing these things right?" This is what I was thinking of when I wrote "far, far over the line."

Well, that's pretty clearly terrible and unhelpful!

Re: A Sad Day for Rust

#217

Post by SkyBelow » Fri, Jan 17, 2020, 4:11 PM UTC

endothrowho333 wrote: post #122

disintegore wrote: post #70

Earlier quoted context omitted.

A community grows and eventually reaches the point where users cannot recognize who they're interacting with nearly every time, where the submission queue is trailing down too fast for any single reader to process. When that happens, it can no longer function as a cohesive community. It becomes about as personal as a magazine about the very same topic. Furthermore, the incentives to post change due to the higher pote…

The above was from personal experience and observation from having been a part of many online communities -- pre-dating reddit -- in all ways including: here-and-there member, first-hand maintainer and manager, and antisocial member causing a ruckus. Armchair psychology? No, I've made many friends and acquaintances, both online and in real life. The ones that bubble around posting online heavily, have developed antis…

>Armchair psychology? No, I've made many friends and acquaintances, both online and in real life. The ones that bubble around posting online heavily, have developed antisocial tendencies that were reinforced through social exclusion. A self-fulfilling prophecy. I know this, because I know those people well and because I was there at one point in my life as well.

This would still qualify as anecdotal data, and thus armchair psychology. Now, it works perfectly valid as a hypothesis and can be rigorously tested and determined if data reject or supports (fails to reject) it. But without peer reviewed research, that last step hasn't happened.

It also sounds good. Makes sense. Fits our notion of common sense of how humans works. The problem is that psychology is filled with examples of where these kinds of intuitions are wrong.

Re: A Sad Day for Rust

#218

Post by Brave-Steak » Fri, Jan 17, 2020, 4:12 PM UTC

All discussion I saw about the issue was quite civilized.

https://old.reddit.com/r/rust/comments/epzukc/actix_web_repo...

https://old.reddit.com/r/rust/comments/epoloy/ive_smoketeste...

I get that people hate Reddit around here, but pushing this on them as vitriol by the Rust community there is wholly unfair. The impression I've gotten is that the developer of actix used unsafe too much, made no attempt to inform users that his framework was thus not safe to use (to the level expected of a Rust project), and rejected plenty of PR's where these issues would've been fixed, while being belligerent about continuing to write unsafe code.

https://cdn.discordapp.com/attachments/648807492931026953/66...

He'd even started deleting comments and entire issues just for pointing out unsafe code. And it seems like he's had the archives deleted, since the archived pages which used to exist are no longer accessible (I didn't even know that was possible?).

http://web.archive.org/web/20200117043715/https://github.com...

Frankly, after years of seeing people defend C/C++ projects because "well, just get better", I think it's a good thing that security-consciousness is at a point where developers are being rightly criticized for playing fast and loose with security. There are always complaints about how we have no idea what kind of code being used on NPM or other package systems. But make some effort to improve it and now they're the bad guys? Oh, come on. You can't have it both ways.

And as somebody else has already pointed out, plenty of other projects also had PR's regarding safety issues, as linked by the original article which tested all these projects. The actix author is the only one who rejected them, and he's the only one facing complaints.

Re: A Sad Day for Rust

#219

Post by steveklabnik » Fri, Jan 17, 2020, 4:12 PM UTC

jimbokun wrote: post #200

steveklabnik wrote: post #128

Earlier quoted context omitted.

You cannot get the full context from a single reddit thread; as I mentioned in the post, this situation is the product of multiple events. You'd at least need the posts from all of them, let alone that this is only one of the posts from this situation on reddit in the last day.

I think that's where some of the confusion comes in. You say: "Some people go far, far, far over the line." So some people are assuming this is just the maintainer responding badly to people pointing out problems with his or her code, but you are saying it went far beyond that into personal attacks?

Yes, they did. I posted an example of a particularly egregious one elsewhere in this thread.

Re: A Sad Day for Rust

#220

Post by UncleMeat » Fri, Jan 17, 2020, 4:13 PM UTC

izacus wrote: post #145

deng wrote: post #100

Earlier quoted context omitted.

As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.

> As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you. Sure, but that DOES NOT mean you're immune to criticism, especially when it comes to security. Your type of argument could otherwise be used for pretty much everything - even large corporations. It's not useful.

Criticism is one thing. Dog piling and vitriol for the sake of feeling superior and joining a circlejerk is another thing.