Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Sad Day for Rust

words.steveklabnik.com

Post reply on HN
Print view View original

31–40 of 1001 posts

Re: A Sad Day for Rust

#31

Post by Twirrim »

mileycyrusXOXO wrote: post #12

I understand maintaining open source is a lot of work and why someone might want to call it a day - but this is probably the least professional way someone could do it. People depend on this software. It is inconsiderate to just move it to private instead of taking the time to hand it off to someone else. I'm 80% through building an API using actix-web. Time to reassess whether or not I should start over - wonder wha…

One question that you should be asking yourself with some urgent priority is: Can I even trust an application I've built with actix-web?

Ignoring the drama around it, there were some very serious security concerns with the liberal use of unsafe.

Re: A Sad Day for Rust

#33

Post by jerf »

CoffeePython wrote: post #3

Tried reading through this but without context it’s very unclear what has happened. Can someone familiar with Rust and it’s communities explain from a high level what all this is about?

The really short answer seems to be: actix was a Rust web framework. It did some things internally that some people didn't like. The Internet echo chamber picked that up and amplified it to a volume the maintainer couldn't justify working through. The Internet echo chamber is now going to pick this up and amplify it to a volume that probably isn't justified either.

I think this is another story about the destructive power of the internet echo chamber, where the asymmetry of one person vs. a mob of people who are in reality probably not all that engaged with the problem but nevertheless have enough engagement to send a nastygram or two creates a distributed denial of decorum attack that no single human being should be expected to deal with "nicely". Our ancient instinctive tribal signals of whether or not you are approved by the tribe, tuned for tribes of 150 people or so, receive a message that 15,000% of the tribe thinks you are a bad person, and our natural human response to that is a lot of stress at best (our ancient instincts tell us that eviction from the tribe is a bad thing, even though in practical terms eviction from this particular tribe won't be much of a problem at all in the modern world).

(I phrase it this way because I think this is, well, not strictly speaking independent of the question of whether or not the maintainer was guilty or innocent of any particular thing, but because the story is the wild disproportionality of the response you can get on the Internet regardless.)

Re: A Sad Day for Rust

#35

Post by ekianjo »

ginko wrote: post #16
vunie wrote: post #6

I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project. No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Of course, you could…

I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILIT…

> I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply

This is a really bad answer because the most reliable and robust free software projects out there all use this same boilerplate license warnings. This is just for legal protection.

Re: A Sad Day for Rust

#37

Post by jimbokun »

ginko wrote: post #16
vunie wrote: post #6

I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project. No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Of course, you could…

I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILIT…

Sure, so in the case of actix-web, the decision of many has been to stop using the project because it wasn't safe.

I didn't see any discussion of legal liability, just a community deciding to stop using and supporting this library.

(Just going by Klabnik's article, I knew nothing about this library before reading it. There may be more context of which I'm not aware.)

Re: A Sad Day for Rust

#38

Post by ddevault »

A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this.

I have two simple mantras which establish my philosophy here:

1. YOU are responsible for your dependencies.

2. Open source participants are volunteers and owe you nothing.

It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change anything in the slightest. Your dependencies are your responsibility. Responding with vitrol, anger, or hate when failing to uphold this responsibility bites you in the ass is just being a jerk.

User entitlement is totally unjustified and will burn out maintainers faster than almost anything else. I don't stand for it. If any other maintainers out there are struggling with this, please send me an email: sir@cmpwn.com. I'm sympathetic to your cause and I can likely lend some pertinent advice.

Re: A Sad Day for Rust

#39

Post by steveklabnik »

shadowgovt wrote: post #36

I haven't seen the phrase "contempt culture" before, and I want to thank Steve for bringing it to my attention in this article. Thanks Steve. :)

You're welcome; I think it's one of the most important concepts for programming communities to understand. Felt like a revelation when I read it, as someone who was previously very contempt-ful and regrets it.

Re: A Sad Day for Rust

#40

Post by GolDDranks »

olah_1 wrote: post #11

I actually think the "code of conduct" culture that Rust embodies exacerbates this kind of drama. Ironically, it creates a more unsafe environment where everyone feels anxious and judged by the CoC Police. Under the CoC, I am entitled to a wonderful experience, and if I don't get it, the culture has failed in its commitment to me.

That's hardly what happened, though.
Post reply on HN