621–630 of 797 posts
Earlier quoted context omitted.
this is not normally a problem for a distro where the environment is well known
It is such a non problem it forced them to hack a „fuck you this Python is owned by the distribution not you“ message into pip requiring you to agree to „breaking your system“ to use it. Of all the languages, python in the base system has been an unmitigated garbage fire.
Earlier quoted context omitted.
What a horrible mindset. I'll never understand this "security" argument. It is our responsibility to our users to provide them the most secure option possible as the default. Removing features is not the most secure option possible. Go all the way then and remove everything. Only when your computer cannot do anything it will be 100% secure.
Just annoys me that he calls features "crap" just because he likely doesn't use them personally and ends that post with a random sentence claiming such a version "increases the risk of drive-by attacks" with zero evidence. The developer explains the features aren't plugins and aren't even enabled by default. Arrogance from maintainers like this from within Debian is what will hurt it far more than any external entity…
"All of these features are superfluous and do not really belong in a local password database manager" seems to me like a pretty clear explanation of what is "crap" about them, and it seems pretty clearly not to be about personal taste.
Some people care about modularity.
Interesting how a person's opinion can change: https://news.ycombinator.com/item?id=27594688
I think this is the wrong way to promote rust. For me rust is just a hype. I know nobody that programms or even thinks about rust. I’m from the embedded world an there c is still king. I understand that some will see rust as a good alternative, but as long as the real money is made in c it is not ready
I program mostly Python, C, C++, Javascript and Rust. Including on embedded (that goes for C, C++ and Rust) Most people nowadays who criticize Rust do so on a cultural basis of "there are people who want this so and it changes things therefore it is bad". But never on the merits. Rust is a good language that contains in its language design some of the lessons the best C programmers have internalized. If you are a ste…
In this mindset, arguing against change is an argument on the merits. Because everything you spend time on has the opportunity cost of everything else you could spend time on.
Earlier quoted context omitted.
It is such a non problem it forced them to hack a „fuck you this Python is owned by the distribution not you“ message into pip requiring you to agree to „breaking your system“ to use it. Of all the languages, python in the base system has been an unmitigated garbage fire.
> it forced them to hack a It was not their action, nor is it hacked, nor is the message contained within pip. The system works by pip voluntarily recognizing a marker file, the meaning of which was defined by https://peps.python.org/pep-0668/ — which was the joint effort of people representing multiple Linux distros, pip, and Python itself. (Many other tools ignore the system Python environment entirely, as mine wil…
Earlier quoted context omitted.
yes because then you're starting to use non-distro python packages. If you want to do that, use a virtualenv, there is no safe other way (even if there was no python in the base system) .
Yes, the distro people are strong believers in virtual environments as best practice - for you, not them.
The tricky part is when "users" start using pip to install something because someone told them to.
Earlier quoted context omitted.
> In particular, our code to parse .deb, .ar, .tar, and the HTTP signature verification code would strongly benefit from memory safe languages > Critical infrastructure still written in C - particularly code that parses data from untrusted sources - is technical debt that is only going to get worse over time. But hasn't all that foundational code been stable and wrung out already over the last 30+ years? The .tar and…
> But hasn't all that foundational code been stable and wrung out already over the last 30+ years? No: a little less than 5 years ago there was CVE-2020-27350, a memory safety bug in the tar/ar implementations.
Earlier quoted context omitted.
> Because you’re young or you weren't around in 2010 when Go was gaining adoption. I've been working as a programmer since the mid-90s >> I'm battling to think of any other about-to-go-mainstream language that had the reputation of a hostile community. > People said “I like the language, it’s quite useful” followed by tirades from people who thought it was the end of human civilisation. And? That's not the same as ha…
> not the same as having a hostile community Hostile according to who? According to the haters, maybe. I’m sure the Go community was called “hostile” by haters back in the day. Look at the drama created by Linux maintainers who were being insanely hostile, coming up with spurious objections, being absolute asshats - to the point where even Linus said enough was enough. The Rust for Linux members conducted themselves…
I also notice that these language debates are very much generational. That has a few consequences. First is that older devs have thicker skin. Second, older devs are more wary of the big promises made by Rust. Whether you like it or not, the push for Rust very much comes across as naivete as much as anything to older, more experienced devs who have seen this type of thing before.
You can't write a device driver without manipulating memory directly. A OS Kernel has to manipulate memory directly by definition. Most academic research into memory safe languages is mixed with a high amount of null results (meaning it doesn't work). Yet the Rust folks push it as the 'one true way'. Meanwhile, most Rust OpenSource projects are abandoned currently.
Its not hate, its pointing out track record and avoiding repeating past mistakes due to painful experiences in our youth. Your determination to repeat past mistakes doesn't come across as enlightenment like you think it does.
Earlier quoted context omitted.
> I didn't see C++ users jumping into Rust threads posting attacks There absolutely are, and have been. You could say it's a reaction. I don't want to argue about who started it. I agree with you that if the Rust community has gained such a peculiar reputation, it's also due to valid reasons.
From the outside looking in most of the push back against rust seems to be of the "I am too old, never make mistakes, and don't want to learn a new thing late in my career" variety. I have rarely seen an argument that pushes back against Rust with actual alternative solutions to the problems the rust proponents are trying to solve. It is mostly a bunch of old people letting the perfect be the enemy of the good.