A Sad Day for Rust

It seems much of the disagreement may stem from lack of consensus around the semantics of:

'responsibility'

'requirement' 'obligation' 'should' 'can'

I believe responsibilities are personal/societal. They're part of a value system. However, I think I could collate a breadth of sources from landmark open source discussions which show that there are existing major themes for what a maintainer has a responsibility to do (that the open source community has a somewhat predefined value system existing wrt to topic).

I accept that it's not a consensus.

I just don't think we should conflate obligations, requirements, and responsibilities. That leads to vehement disagreements.

> Open source participants are volunteers and owe you nothing.

And a lot of the internet has this wrong, including you.

Let me start by saying that Open Source is not a zero-sum game. I can make a library like your library and it doesn't have to be an adversarial relationship. I have users, you have a few less users.

But there are costs to having more. There is still only so much space in the ecosystem for so many actors. The more logging libraries we have the harder they are to find, the more drama there is over picking one...

The best analogy I have is a party. If I throw a party this weekend, and your birthday is next month, then I'm not hurting you. If I throw it the weekend of your birthday, knowing it's your birthday, I'm kinda being a dick. That's not cool, and you have every right to be upset.

Okay, but what does any of this have to do with Open Source projects, hinkley? I'm within my rights to throw a party. But my guests are within their rights to be upset if I throw a shitty party. They showed up. They could have been doing something else. But I insisted on taking up space and now I'm being ungracious about it. It's my party and I can treat people how I want is technically the truth, just like "I can do Open Source and ignore the concerns of my users" is technically the truth.

What I'm saying is that the people who show up don't have to like it. They're entitled to complain to people about it, especially if I don't apologize and say I'll do better next time, or get help.

It's my party, I can cry if I want to, but people are gonna talk.

[edit to add]

I think the problem is that we have a bunch of people who throw themselves into software at a young age because of or at the expense of social awkwardness, and we insist on treating things and other people as if they are machines instead of people who are also just trying to do the best they can. I'm fully aware that this observation cuts against my argument as well as supporting it, but we can't go on coddling people and organizations for ignoring the very real social aspects of our work. For being poor hosts.

And it's really hard, believe me I know. But people want to see that you're at least trying, or they will paint you the villain.

A lot of guesswork and generalization, right there.

I generally believe people should be polite.

But when you open source a project, you are opening yourself up to criticism and critique of your work. You are opening yourself up to that in basically any form the internet wants to take it, and sometimes that really can be shitty.

We have a very promising project making use of a language that has gained popularity largely based on marketing around memory safety, and then that project has unnecessary and flawed use of something that undermines the messaging around rust. This is a risk for Rust - a promising and popular project in a popular space that undermines some of the core rust messaging is a PR problem for the language. The maintainer not being receptive to contributions to resolve this difference is a problem. The maintainer not being receptive to contributions that fix SECURITY ISSUES is a MAJOR problem.

Open source maintainers are, of course, volunteers. I don't think we should hold them responsible for the fact that there are bugs in their code, or even security flaws. People aren't perfect, and no one should be expected to be, especially when contributing something to the open source community. But we SHOULD hold them responsible for not fixing security issues. It's irresponsible to release something to the public that you know puts them at risk.

So is it fair for people to be upset in this situation? I think so. I also think their reaction should be a polite one - but it's totally fair for people to push someone to take responsibility for code they've introduced to the world that has security vulnerabilities in it.

If you had discovered Heartbleed, would you have kept that knowledge to yourself so that you could minimize the maintenance burden on the OpenSSL develoopers?

Granted, no one died over Heartbleed but it caused lots of real people harm. We should start worrying about the well being of our fellow human beings long before their lives are at stake.