Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Sad Day for Rust

words.steveklabnik.com

Post reply on HN
Print view View original

671–680 of 1001 posts

Re: A Sad Day for Rust

#671

Post by prepend »

derefr wrote: post #303
deng wrote: post #100

Earlier quoted context omitted.

As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.

Sure, but once you’ve forked, now you have a fork only you use, but which you know is more secure than its upstream for reason X. That’s an unstable equilibrium—you want others to know of your fork, and to switch to it, so that other downstream projects can also be more secure. Adding to this, you might still transitively depend on the upstream through your other deps in ways you can’t change without either forking a…

If enough people support your idea you will get a new community around your fork.

Or you can pay the cost of bringing in changes from the upstream project. This happens a lot for commercial software. I remember having to maintain a “fork” of BEA’s WebLogic server for a year or two until they incorporated changes my employer needs.

It’s not so bad.

Re: A Sad Day for Rust

#672

Post by zozbot234 »

protomyth wrote: post #319
cerebellum42 wrote: post #231

Earlier quoted context omitted.

Maybe that is what the developer intended, but afaik it is not what he communicated. What he communicated was a flat out dismissal of the issue along with the proposed fixes. Followed by deleting the whole issue from GitHub. To be fair, there were some very unpleasant things said in there, but he could have just deleted those and maybe locked the conversation telling people about his plans. This whole thing was a fee…

So, how fast do people expect developers of open source projects to respond before someone is considered unresponsive? I'm not sure combining social media with code control is going to be such a good thing for a lot of developers who might not like to program in a fishbowl.

Expecting a reasonably-quick response to security concerns is certainly appropriate.

Re: A Sad Day for Rust

#673

Post by war1025 »

steveklabnik wrote: post #178
duxup wrote: post #133

Help me out here is actix-web some sort of software that is integral to Rust? If not ... I get the idea he wasn't really welcoming of the changes but at the same time. It's his code man. I came from the world of networking and etc and the world of programming has a great deal of personal preferences / hypothetical problems / "we don't do that at my workplace" stuff pushed under the guise of technically correct ... so…

Integral? No. Used in production, by companies? Yes. Outwardly visible? Absolutely, due to Techempower. Rust will survive without actix, but losing it is a setback for Rust in the web space.

If it's LGPL can't someone just put up a new fork of it and people transition to that?

Re: A Sad Day for Rust

#674

Post by mirekrusin »

Wowfunhappy wrote: post #614
ddevault wrote: post #38

A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this. I have two simple mantras which establish my philosophy here: 1. YOU are responsible for your dependencies. 2. Open source participants are volunteers and owe you nothing. It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change…

> Open source participants are volunteers and owe you nothing. I can't agree. Not for all participants. Let's take Linus. He's in charge of the Linux project, which thousands (millions?) of people contribute to every day. If Linus suddenly stopped merging any and all patches—but refused to officially step down—what do you think would happen? Oh, the project would more than survive—someone would fork it and that would…

I think you're missing a point. If you promise something, people will get upset if you don't deliver. There were no promises made here. If you want to compare it to your example, it's more like your "primary teacher" would ask you to cover one week after other and after 3 years you'd say you just won't do it anymore - should anybody be upset at you?

Re: A Sad Day for Rust

#675

Post by oaiey »

Ygg2 wrote: post #354
deng wrote: post #100

Earlier quoted context omitted.

As a maintainer, it is his choice which patches to accept. If you're not happy with his decisions, choose another project, fork it, or pay someone to do it for you.

As a maintainer, I treat almost all PR submission with kind words. What actix developer did was, to pardon my French, inexcusable. Deeming security patch boring? Making your own `Cell`, implementing it badly and misusing it, because it's faster on some stupid benchmark site? If we designed cars like that, they would have no breaks, no gears and no cabin. Honestly, I think it's better Rust abandons `actix` asap. Befor…

The same "stupid" benchmark site let to dramatical improved .NET Core performance , re-engineered the .NET Server stack and even changed the C# language on the way.

I do not know how the Rust community manages performance comparison, but the .NET bubble was broken by that page and resulted in awesome results for the platform.

PS: just pointing out what the page achieved somewhere else. The discussion about the maintainer and what happened there is a different topic.

Re: A Sad Day for Rust

#676

Post by cosarara »

the_af wrote: post #591
jakear wrote: post #357

Earlier quoted context omitted.

Did the patches obviously maintain the exact same behavior? If so, why should the author care about them? If not, it’s not the author’s responsibility to ensure they’re correct patches, but it is the author’s responsibility to ensure their package is correct. If it was correct already (not sure about this, but it seems it was very popular and used in production, so I imagine it worked well), they have no responsibili…

> I would be very unlikely to accept a patch that simply changed the internal typings for the abstract goal of “fewer any”s. Out of curiosity, isn't a focus on that kind of things precisely the goal of Rust? I understand your point, but this was software built for Rust, which has this kind of thing (safety, the right types, etc) as a primary goal. From https://www.rust-lang.org/ : > "A language empowering everyone to…

> is Rust really for them?

Maybe he likes rust because of other things. He had a very successful project with rust, it seems weird to think that rust was not the tool for him.

Re: A Sad Day for Rust

#677

Post by watwut »

oaiey wrote: post #660
Wowfunhappy wrote: post #614

Earlier quoted context omitted.

> Open source participants are volunteers and owe you nothing. I can't agree. Not for all participants. Let's take Linus. He's in charge of the Linux project, which thousands (millions?) of people contribute to every day. If Linus suddenly stopped merging any and all patches—but refused to officially step down—what do you think would happen? Oh, the project would more than survive—someone would fork it and that would…

Linus is paid to carry that responsibility. Others are not.

This is factually correct statement while apparently downvoted. Linus Torwards is paid for his effort. Which is also actually right state of things, not an insult.

Re: A Sad Day for Rust

#678

Post by zozbot234 »

TrueDuality wrote: post #533
velcrovan wrote: post #211

Earlier quoted context omitted.

Backing up another level...it’s concerning to me when a language relies heavily on single-maintainer libraries for commonly needed functionality. If actix-web was this important, it should have been adopted by the community before now. Maybe languages need a way of setting the expectation to that if your library becomes essential to the community (and if licensing allows) the core developers are going to fork it and…

The developer actively fought against this for a very long time, even before the reddit shit storms. Yes the community could have forked the project and started independent development. I'd argue that forking and developing independently of the developer is as big of a middle finger as a developer taking their ball and going home. It just depends on who is on the receiving end. I don't think either side is right here…

> I don't think either side is right here, but I don't think creating a public fork and building a community around that is an unbiased and neutral response

Linux distro maintainers routinely create "public forks" even of actively-maintained packages, and no one sane views that as a hostile move or something to complain about. It's part of curating a well-kept ecosystem around your solutions.

Re: A Sad Day for Rust

#679

Post by temac »

xscott wrote: post #529
logophobia wrote: post #475

Earlier quoted context omitted.

It was advertised as a production-ready web-framework, and it was very popular. When do people get to complain? "Oh, my credit card information was stolen due to memory issues in this web-service, it's fine though, we didn't pay the guy, so we can't blame him.". Web-frameworks are cornerstones for security, and if you write one, advertise one, you need to care about security. Features, code-style, ad-hoc PRs, bug-fix…

> if you write one, advertise one, you need to care about security No, you don't. The author doesn't owe you a single thing unless you have a warranty saying otherwise. Most licenses explicitly say something like: THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE If you don't…

Half (more probably 99% actually) of our critical infrastructure software use that wording (or an equivalent one), regardless of it is free software or proprietary software.

Yet most are maintained responsibly, if they are used for serious stuff and/or advertise in a way that suggest that kind of usage can be considered.

Re: A Sad Day for Rust

#680

Post by adamredwoods »

iovrthoughtthis wrote: post #402
solipsism wrote: post #306

Earlier quoted context omitted.

This is a bit Pollyanna. People aren't logic robots that start from first principles and then derive all knowledge from logical reasoning. People are emotional, irrational beings. Those of us who fancy ourselves rational are constantly involved in irrational motivated reasoning helping us maintain that desired worldview. Not to say we shouldn't try to live up to the ideal you set forth. We should do our best. But the…

I’m not so certain emotion and logic are so fundamentally separate you know. Perhaps logic is just our way of explaining our otherwise unexplainable decision making systems.

It's biological (aka biological determination). There's the famous study of how judges handed out verdicts based on what or when they ate:

https://www.pnas.org/content/108/17/6889

Post reply on HN