Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Sad Day for Rust

words.steveklabnik.com

Post reply on HN
Print view View original

601–610 of 1001 posts

Re: A Sad Day for Rust

#601

Post by dnorman »

zozbot234 wrote: post #420
Traster wrote: post #254

Earlier quoted context omitted.

That article from Shnatsel is really stunning, just everything about is negative and snarky- to a comical point. His avatar is a cartoon pony doing a facepalm! I find it kind of funny that the author of this has singled out reddit for criticism when seemingly prominent members of the Rust community are perfectly willing to be so openly toxic.

Being negative and snarky about crappy, hacked-together code that might cause security issues all over the place is not a bad thing. Yes, most of the snark there is about 'http' crate with its weird custom implementation of basic data structures.

It is absolutely a bad thing to be negative and snarky. It sews resentment within the community and taints potentially valid points. One can express legitimate concerns and be heard without putting oneself on a pedestal or diminishing the self-worth of others. We as a community must take responsibility for fostering a merit-based discourse, and reject pettiness and snark.

Re: A Sad Day for Rust

#602

Post by steveklabnik »

proximitysauce wrote: post #484
steveklabnik wrote: post #128

Earlier quoted context omitted.

You cannot get the full context from a single reddit thread; as I mentioned in the post, this situation is the product of multiple events. You'd at least need the posts from all of them, let alone that this is only one of the posts from this situation on reddit in the last day.

I mean this in the most respectful way possible, but have you considered your own antagonism against Reddit is not healthy for the community? Throughout the years I've seen you talk down about Reddit and the people there quite a bit. I get that they're "rougher" than the ideal Rust citizen but they're also real people and members of the community. It's probably best not to judge one of the largest sites on the intern…

I go back and forth on it. I try to also say that I think /r/rust is better than most Reddits, but I think the core problem is structural, and what I say doesn’t matter that much.

Re: A Sad Day for Rust

#603

Post by C14L »

This is really bad. Actix Web is such an awesome framework.

Reddit has become such a toxic place since they optimized the platform to make money.

Why don't those idiots just fork Actix Web and make a "no unsafe" version of it? Instead of harassing the author, who has devoted so much of his time and talent to building this great piece of software?

Re: A Sad Day for Rust

#604

Post by mumblemumble »

_-___________-_ wrote: post #352

I've written a lot of Rust code that's in production in web, messaging and telephony contexts. I considered using Actix early on, but as soon as I saw the large amount of unsafe code, I stopped considering it at all. I did not go on the Internet and try to convince other people not to use it. I did not complain at the maintainer that he should manage his project differently. I just didn't see why a library doing what…

I hit a same conclusion about a popular framework (that shall remain unnamed) on a different platform a few years back.

It feels like it should be simple: I disagreed with how the maintainer was doing things, so I decided the package was not for me. No need to hassle them about it. I wish it could be that simple.

Instead, I had to weather a fair bit of defending my choice to use a different, less popular option, and there's apparently no honest answer I can give that won't be taken as an attack on the framework or its users. And refusing to engage with the question is, of course, rude.

I'm finding that Internet culture wears me down, these days. Even when you don't go looking for flamewars, they come looking for you.

With less-popular libraries, it's easier. Open an issue, say hi, make sure the maintainer knows what you're planning on doing, do it, learn a few things, have a nice day. Once or twice I've been asked to more-or-less rewrite the patch because the maintainer didn't like something about my coding style, which is also fine, and often a good way to try a different way of doing things on for size. It's all pretty benign. But popular, well-known projects have this way of getting political.

I suspect that the worst thing that could possibly happen to one of my labors of love would be for lots of other people to like it, too. A few people, great. But I don't want my free time to become Internet politicized.

Re: A Sad Day for Rust

#605

Post by xscott »

pjc50 wrote: post #273
amyjess wrote: post #237

Earlier quoted context omitted.

And this is why I honestly don't ever want to release an open-source project. At the very least, I'm not going to make it easy for people to contribute. I'll keep the git repo private, go without a ticketing system, and just post tarballs full of code on a self-hosted website (I guess like the NetHack team used to do before 3.6, but they had a ticketing system, and I wouldn't). Maybe I'll even use a non-free license…

Why? I mean, if you're that hostile to collaboration, why not just keep it closed source and maybe try to charge for it?

If I write something useful, I'm willing to share it with people when I can. It makes me happy knowing I contributed something that might make the world a smidge better.

That doesn't mean I'm willing to accept your patch. As soon as I accept collaboration, I need to worry about copyright on the contributions, whether they follow my coding style, and whether I'm willing to accept additional complexity for features I don't care about.

Re: A Sad Day for Rust

#606

Post by mratsim »

oefrha wrote: post #85
vunie wrote: post #6

I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project. No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Of course, you could…

According to https://github.com/actix/actix-web , it appears that the author did accept the security concerns (when an actual use-after-free was found, but maybe not the previous, generic “unsafe oh noz” shitstorms), and wanted to explore some other way to fix the problem instead of accepting the patch as is. Just because there’s a patch that fixes the issue doesn’t mean the maintainer has to merge that patch.

The maintainer still shouldn't dismiss a patch + test case with "it's boring".

Re: A Sad Day for Rust

#607

Post by gameswithgo »

endothrowho333 wrote: post #122
disintegore wrote: post #70

Earlier quoted context omitted.

A community grows and eventually reaches the point where users cannot recognize who they're interacting with nearly every time, where the submission queue is trailing down too fast for any single reader to process. When that happens, it can no longer function as a cohesive community. It becomes about as personal as a magazine about the very same topic. Furthermore, the incentives to post change due to the higher pote…

The above was from personal experience and observation from having been a part of many online communities -- pre-dating reddit -- in all ways including: here-and-there member, first-hand maintainer and manager, and antisocial member causing a ruckus. Armchair psychology? No, I've made many friends and acquaintances, both online and in real life. The ones that bubble around posting online heavily, have developed antis…

that is armchair psychology.

Re: A Sad Day for Rust

#608

Post by gbear605 »

jasondclinton wrote: post #532
kungtotte wrote: post #510

Earlier quoted context omitted.

Steve Klabnik makes this point in his write-up, but I'm restating it here for clarity. You don't get to cherrypick who is part of your community or not when these situations arise. Those "bad apples" are part of the Rust community, and the Rust community needs to take responsibility for them the same way any community needs to take responsibility for their bad apples even if it's just to denounce their behaviour. Goo…

Should a politician be held responsible for every unhinged, vitriolic tweet by one of their supporters?

Maybe not the politician, but the general group of “supporters of politician X” should be.

Re: A Sad Day for Rust

#609

Post by badloginagain »

asjw wrote: post #364
makomk wrote: post #176

Earlier quoted context omitted.

So basically, if you use open source code in your code, you should expect there to be security vulnerabilities which people know about and are keeping quiet about because it'd be unfair to the unpaid creator to criticise them? Tbat sure makes it sound like it's morally irresponsible to use open-source rather than purchased commercial code in something like a web-facing service in 2020, especially given what we know n…

> if you use open source code in your code, you should expect there to be security vulnerabilities You should be able.to fix them yourself That's the premise of OSS if you don't want to pay for a cab or a driver, you should be able to drive

You can fix them yourself, by duplicating the car and fixing it yourself. You can't force someone else to fix the locks on their car

Re: A Sad Day for Rust

#610

Post by nickbauman »

jupp0r wrote: post #250
nickbauman wrote: post #209

Earlier quoted context omitted.

When you write "... the Rust project saw Rust as more than just the language. The community and the people mattered." I have to ask why anyone thinks this isn't true for ANY code/stack/dep out there? When I evaluate a technology for its appropriateness I first look at who's using it: Literally "Who are these people and what are they working on with this stuff?" The answer to this question determines more than 80% of…

> Rust seems to be being used most by people who are interested in blockchain and crypto. What makes you think that? I don't believe that is true, it's like saying C++ programmers are mostly interested in high frequency trading.

Well then who are these people?
Post reply on HN