Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actix project postmortem

github.com

Post reply on HN
Print view View original

341–350 of 408 posts

Re: Actix project postmortem

#341

Post by geofft »

Tehchops wrote: post #238
geofft wrote: post #99

Earlier quoted context omitted.

It's absolutely correct that people don't have obligations simply by putting some code online. But they do have obligations when they start telling people to use their code. We understand this as humans even in realms far from open source: if I see you approaching a door, I am under no obligation to open it just because I'm physically able to, but if I open a door for you, I'd better hold it until you're finished wal…

> It's absolutely correct that people don't have obligations simply by putting some code online. But they do have obligations when they start telling people to use their code. We understand this as humans even in realms far from open source: if I see you approaching a door, I am under no obligation to open it just because I'm physically able to, but if I open a door for you, I'd better hold it until you're finished w…

> Th e artifacts of these little meltdowns are exactly the kinds of things your upper management will cite the next time you suggest using FOSS vs. whatever vendor they're about to push down your throat.

Yes, this is what I don't understand - we spent decades fighting the perception that open source could never be as good as proprietary commercial software. Now that we've mostly convinced our bosses, we want to turn around and say, no actually an open source maintainer who writes buggy code, rejects patches, and takes down their project when called on it is doing exactly what he should do?

Of course he has every right to do that, but this shouldn't be (and fortunately isn't) the norm. Defending this outcome as the expected outcome just means that the bosses will quite justifiably say, suppose we use this software and I let you publish patches back, you're telling me to expect that the upstream author will take their code offline? Why should I use this software at all, let alone let you waste your time on patches? I'm gonna buy from Oracle.

Re: Actix project postmortem

#342

Post by geofft »

avereveard wrote: post #290
jturpin wrote: post #255

Earlier quoted context omitted.

> Like it or not, there are implicit social contracts if you maintain OSS software. I think I agree, and its tricky because its really hard to pinpoint what the contract is (without sounding "entitled"), like there is with any social contract I guess. Maybe it even depends on the various cultures of the people working on the project.

that contract is precisely spelled in the license file, idk what you all are on about.

The social contract is generally not written down anywhere. Here's what we're all on about: https://en.wikipedia.org/wiki/Social_contract

I consent to let other people make demands of my OSS because I wish to make demands of their OSS because together we can build a better world than either of us could on our own - because I am consenting to be part of a community. I have security-sensitive Rust code on GitHub. I'm careful about unsafe, and I welcome people filing bugs, because I want the entire ecosystem to be good about unsafe, and so I need to do my part in that.

Re: Actix project postmortem

#343

Post by geofft »

kazinator wrote: post #175
geofft wrote: post #99

Earlier quoted context omitted.

It's absolutely correct that people don't have obligations simply by putting some code online. But they do have obligations when they start telling people to use their code. We understand this as humans even in realms far from open source: if I see you approaching a door, I am under no obligation to open it just because I'm physically able to, but if I open a door for you, I'd better hold it until you're finished wal…

If someone is relying on your code, that means they have their own copy of it. You're not obligated to keep your copy online.

As an open-source developer myself, I'm annoyed when people do that. I want them to rely on my product, not my code. I want them to update when I publish new versions and I want them to send patches back.

There are even almost-open-source licenses that compel you to send patches back. I don't want to use one. I want to treat them with respect and I hope they treat me with respect in turn.

Re: Actix project postmortem

#344

Post by ww520 »

AzzieElbab wrote: post #250
ww520 wrote: post #246

Good for him to make a stand! I can completely understand how he felt. Similar things happened to my open source projects, admittedly at a smaller scale. Users became so entitled to open source software and became hostile. Well, i nipped the problems at the bud by moving the projects off open source license. There were a few people crying foul and vowed not to use it. Fine. I respected their choices, and let's move o…

would you have declined a patch that fixes a real problem because it is boring? i do not really get that kind of thinking either. personally i would have accepted it and replaced with something clever latter on

Yes, I would. Because that patch is a "style" patch. It's not important in the author's roadmap for the project.

People ask for different things and think their things are the most important, and when they don't get their way, screaming and kicking to force them in. They can always fork it or create a separate project if it's so important.

Re: Actix project postmortem

#345

Post by geofft »

capableweb wrote: post #323

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO This is part of the MIT license. Many other open source and free software licenses contain the same thing. It's simple, people provide software they write in their free time or "sponsored" by their company, in return they get nothing and you should expect nothing more than the piece of code that gets publi…

The MIT license isn't the only thing Actix wrote. They also wrote this:

https://actix.rs/community/

> Community: The best things in life are to be shared

> Join us - Want to talk to others about questions? The actix gitter channel or reddit community are your best starting point.

> If you think you found a bug it's best to go to the github directly. There are two repositories that you might want to report against. actix for issues with the actor framework or actix-web for the high level web framework.

> We're a welcoming community so don't be afraid to engage. Interactions are governed by our code of conduct.

I agree with you that projects aren't required to do this. (And I also agree that developers often feel pressured to build up a community for their project.) But still - that's what they wrote.

Re: Actix project postmortem

#346

Post by kjs3 »

zokier wrote: post #340
kjs3 wrote: post #214

Earlier quoted context omitted.

Yeah, that's really the core of the problem, isn't it. People trying to impose an implicit understanding (which is nothing more that 'this is what I want the world to be like') when there's an explicit statement of 'this is how it actually is'. The attitude baffles me. So many times I've had someone come in all butthurt and say 'I know it was in the contract, but I didn't think they'd actually enforce it'.

> So many times I've had someone come in all butthurt and say 'I know it was in the contract, but I didn't think they'd actually enforce it'. or the converse situation "I know I used liberal license but I'm still going to raise hell if people actually do what the license allows"

No, that's not the converse. The license says exactly what it means, which is:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,

Period. Calling it a 'liberal license' doesn't mean what you think it means.

Re: Actix project postmortem

#347

Post by growse »

j-pb wrote: post #220
toyg wrote: post #190

Earlier quoted context omitted.

No, he just stopped dropping the package on the street every Monday at 7am. Whoever picked up the package in the past, still has it - or had the option to preserve it. If your workflow relied on a package being delivered every morning, even unchanged, it's your own fault. He never made that guarantee. Stop painting the narrative like people owe you anything, when you're just failing to correctly evaluate the actual r…

Yeah there's this common concept in society called trust, aka a social contract, that people don't advertise their stuff first only to deliberately screw you over. And yes shockingly people are entitled to be treated fairly and not to be sabotaged. And no, providing them with a library for a limited period of time and then being fed up with it's maintenance doesn't somehow earn you that right. It gives you the right…

Caveat Emptor.

Re: Actix project postmortem

#348

Post by growse »

yongjik wrote: post #320

An argument could be made both ways, but I wish people stopped quoting licenses to resolve social issues. For example, the license does not forbid the user of the software from INSINUATING THAT THE AUTHOR OF THE SOFTWARE IS INCOMPETENT, OR UNFIT TO AUTHOR ANY SOFTWARE, EITHER IN A PARTICULAR LANGUAGE OF THEIR CHOICE, OR IN GENERAL. So one can almost say that anyone who's doing it is exercising their right granted by…

> ...But that kind of argument is not really helpful, isn't it? The question is whether some behavior is socially acceptable. License doesn't enter the question.

> (BTW, of course I don't support the kind of behavior I endorsed(?) above.)

Let's say someone wants to release some open source software to the world. But they also want to retain the right to remove their currently published copy at any point, their right to reject patches and generally do what they like without being slurred and berated by everyone else.

Aside from adding a plaintext file alongside the code that explicitly says (sometimes in capital letters!) that the code is supplied with no warranty or obligation, explicitly or implied, what should they do?

Isn't it clearly the case that the license explicitly states the social contract?

Re: Actix project postmortem

#349

Post by smt88 »

phkahler wrote: post #311
smt88 wrote: post #291

Earlier quoted context omitted.

I'm not sure if this will change your mind, but in the Rust world, there's a concept of "unsafe" code that can lead to vulnerabilities. The difference here is that a code consumer can check a Rust project for unsafe code, whereas a food consumer cannot check for unsafe contaminants.

If it's OK to demand a project use only Rust and not unsafe Rust, then it must be OK to bitch at every C or C++ project and demand they rewrite in Rust. If that sounds absurd, that's because it's supposed to.

That's not really an apples-to-apples comparison.

From what I can tell, actix was using unsafe code to improve benchmark performance, not because safe code was extra work. That's fine, but it was misleadingly marketed as more than a toy project, and it shouldn't have been.

Further, rewriting a project is very different from just making different coding decisions when maintaining an existing project.

I still think the actix critics are showing how irresponsible they are for blindly using a library without researching it well.

Re: Actix project postmortem

#350

Post by ghostwriter »

geofft wrote: post #341
Tehchops wrote: post #238

Earlier quoted context omitted.

> It's absolutely correct that people don't have obligations simply by putting some code online. But they do have obligations when they start telling people to use their code. We understand this as humans even in realms far from open source: if I see you approaching a door, I am under no obligation to open it just because I'm physically able to, but if I open a door for you, I'd better hold it until you're finished w…

> Th e artifacts of these little meltdowns are exactly the kinds of things your upper management will cite the next time you suggest using FOSS vs. whatever vendor they're about to push down your throat. Yes, this is what I don't understand - we spent decades fighting the perception that open source could never be as good as proprietary commercial software. Now that we've mostly convinced our bosses, we want to turn…

> Why should I use this software at all, let alone let you waste your time on patches? I'm gonna buy from Oracle.

With OSS you always have an option to keep your personal copy of the source tree, and you have an option to fork it and maintain it at your own expense. When Oracle closes and discontinues the software you rely upon, you are screwed big time.

Post reply on HN