611–620 of 1001 posts
I've written a lot of Rust code that's in production in web, messaging and telephony contexts. I considered using Actix early on, but as soon as I saw the large amount of unsafe code, I stopped considering it at all. I did not go on the Internet and try to convince other people not to use it. I did not complain at the maintainer that he should manage his project differently. I just didn't see why a library doing what…
Earlier quoted context omitted.
This is a bit Pollyanna. People aren't logic robots that start from first principles and then derive all knowledge from logical reasoning. People are emotional, irrational beings. Those of us who fancy ourselves rational are constantly involved in irrational motivated reasoning helping us maintain that desired worldview. Not to say we shouldn't try to live up to the ideal you set forth. We should do our best. But the…
People are not robots, but in terms of reaching agreement between humans, "emotion" is more or less just a difference in priorities, which is one of the ways reasonable people can disagree. If we agree on the facts and we agree on their implications, but we still disagree, it's likely because we weight things differently. Emotions are simply a large component for how we weight things.
A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this. I have two simple mantras which establish my philosophy here: 1. YOU are responsible for your dependencies. 2. Open source participants are volunteers and owe you nothing. It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change…
Agreed 100%. May I add one point? The OSS maintainer should clearly, upfront, preliminarily, outline how do they govern the project: how much are they open to change the project's core values, how responsive on average will they be in terms of opened issues and PRs, roughly how often would they engage in technical architectural debates -- stuff along those lines. I feel many people get toxic if they had unrealistic e…
Why do you think they owe you this? You didn't pay them, and they didn't accept a contract.
A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this. I have two simple mantras which establish my philosophy here: 1. YOU are responsible for your dependencies. 2. Open source participants are volunteers and owe you nothing. It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change…
I can't agree. Not for all participants.
Let's take Linus. He's in charge of the Linux project, which thousands (millions?) of people contribute to every day. If Linus suddenly stopped merging any and all patches—but refused to officially step down—what do you think would happen? Oh, the project would more than survive—someone would fork it and that would become the de-facto new mainline kernel—but there'd probably be a couple weeks of chaos. Does Linus bear zero responsibility because he's a volunteer?
---
Every Saturday, I volunteer as an assistant teacher (they call us "facilitators") at a Girls Who Code club, a free weekly class to teach computer science to young girls. I don't get paid for it, but that's okay—the kids are adorable and teaching them is fun. The primary teacher is also a volunteer.
If we both decided to just not show up one week, and parents brought their children to the library and found an empty room, would that be okay?
Personally, I do think I owe something to those students, and to the primary teacher. I've made a commitment to show up every week and do what I can to help a group of children. My commitment is what matters, not whether it generates income.
Now, there's actually second GWC class for slightly older students which starts right after the first one. Sometimes I help teach that one, and sometimes I go home. I told the primary teacher I'll stay "when I can", which actually means "when I feel like it".
There's certainly a place for doing work without a commitment to continue, but your intentions need to be clear. Most large projects are not going to function without a commitment from someone somewhere in the chain.
One weekend in October, the primary teacher had plans to go traveling in Europe. She asked if I could cover both classes that week. I said I would, and I did.
Earlier quoted context omitted.
I’m not so certain emotion and logic are so fundamentally separate you know. Perhaps logic is just our way of explaining our otherwise unexplainable decision making systems.
My belief is that intuition and emotion are just complex sets of logic that we haven’t understood yet. Put in the time and focus, and one day it will just click.
models which humans will not actually be capable of understanding.
Earlier quoted context omitted.
Being negative and snarky about crappy, hacked-together code that might cause security issues all over the place is not a bad thing. Yes, most of the snark there is about 'http' crate with its weird custom implementation of basic data structures.
It is absolutely a bad thing to be negative and snarky. It sews resentment within the community and taints potentially valid points. One can express legitimate concerns and be heard without putting oneself on a pedestal or diminishing the self-worth of others. We as a community must take responsibility for fostering a merit-based discourse, and reject pettiness and snark.
Earlier quoted context omitted.
No. Just no. They may do so to the worst of their abilities. Thats their prerogative. The only limit might be publishing something that is actively intended to do harm. But I can't imagine a plausible example of that...
You might not believe this, but I agree with you! Doing something to the best of your ability includes the right to be able to suck at it also. I am pressing for absolutely no standard of quality, yet you somehow think that's the case. It's not. I just think that if you're going to call yourself a maintainer of something, then you better at least pretend.
Earlier quoted context omitted.
Meta-comment: Thank you. Online discussion would be much more productive if everyone clearly laid out the principles on which their viewpoint was based. Fundamentally, there are only a few ways honest people can disagree: Different principles, different information, different interpretation, or just plain misunderstanding. (Meta-meta: This is the principle that I believe and based this comment on.) Much of what makes…
In addition to the (great) framework you listed, there is another big factor - incentives. You may be aligned in principles, have the same info etc. but if your incentives are misaligned it can be hard to agree.
However, I was trying to process whether incentives are essentially part of your principles? i.e. if an incentive to do something against your principles is so strong that it wins out, doesn't that mean you've effectively abandoned (or changed) your principles along the way?
Earlier quoted context omitted.
I feel as though there's a certain developer entitlement that also needs addressing though. Just because you made a software doesn't mean I have to use it or like it, and if you are actively trying to recruit me to use it then I am indeed entitled to complain about it. I see it frequently in the FOSS community where someone will suggest some software they made to solve a problem, get told why their software isn't act…
The opinion that the software isn't that good for the problem is cheap to state, and unless the circumstances are exceptional, I would argue it quite reasonable to see it as entitlement. If someone is terribly dressed according to my taste but brags about how amazing the garb is, I'm not going to tell them how they are wrong unless absolutely necessary because of exceptional circumstances. Neither does most people wh…
If they're actively asking me to use their software, isn't that soliciting feedback? If I say 'no, it won't work for me', I've apparently committed some egregious microaggression right? If I just say 'no thanks', what do expect the very next thing they say is going to be?
Earlier quoted context omitted.
I've worked with Rust only rarely, and never built anything real from scratch with it myself, so I'm curious: what tools are available to assess the safety of dependencies? I agree with you in principle that "you are responsible for your dependencies", but how would you go about doing that for a large complex dependency like this?
cargo-geiger will recursively warn you of unsafe code in dependencies: https://github.com/anderejd/cargo-geiger It's not a silver bullet, it will show you areas where memory safety issues could arise, but doesn't necessarily prove the presence of memory safety issues. Memory safety issues aren't the only type of security bug so them being impossible also doesn't mean it's entirely safe. You can think of issues like i…