Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Sad Day for Rust

words.steveklabnik.com

Post reply on HN
Print view View original

771–780 of 1001 posts

Re: A Sad Day for Rust

#771

Post by jdbernard »

layoutIfNeeded wrote: post #556
Animats wrote: post #518

I have been complaining about Rust's "unsafe" for years. There's too much "unsafe" code because there are things that you either can't express, or are very hard to express, in safe Rust. I've pointed out partially initialized arrays and backlinks as key trouble spots. Both are potentially fixable. I've gotten back complicated excuses for not dealing with these design problems. There was a serious denial problem in th…

>You're sending a reference to an array of unknown size. The next argument is literally the length of the array.

No, that's what the caller says is the length of the array and as we already established, they're lying. ;)

In all seriousness there is quite a difference in structures that allow themselves to have guarantees built into the language/tooling (like including the size of the array in the languages basic "array" building block) vs. the more manual book-keeping the C code above requires.

Re: A Sad Day for Rust

#772

Post by justincredible »

sbarre wrote: post #755
golergka wrote: post #626

Earlier quoted context omitted.

I think it's a cultural issue, but I honestly don't see what's so offensive about this comment (I was expecting something far worse), especially if it's factual assumptions are true. Honest question, can somebody explain the issue here to me, and how one would express these concerns otherwise? I feel as if I just don't get American culture of politeness and niceness to appreciate it.

It's a personal attack. The poster is telling the maintainer to quit writing Rust, implying he can never get better and basically demeaning his whole effort. Do you not see how that is (a) not related to the project and (b) rude in any context? If you were, say, singing karaoke and someone came up to you and said "you're awful, never sing again, you're off-key, you don't know the words"... Is that not rude to you?

> If you were, say, singing karaoke and someone came up to you and said "you're awful, never sing again, you're off-key, you don't know the words"... Is that not rude to you?

While the recipient would most likely be offended, the rudeness would depend on: 1) the accuracy of the statement. 2) the standard the karaoke bar holds for its singers.

Re: A Sad Day for Rust

#773

Post by dbcfd »

pgeorgi wrote: post #396
NopeNotToday wrote: post #245

IMO, the most telling point of this is when the author rejected a security patch because it was not creative enough. He was more of an artist than an engineer. What was the patch? It was very strait forward, simple, uncreative change, intention was just to remove unsafe not to fix existing code. I believe software development is one of the most creative work we do, and creativity is part of why we love software devel…

> He was more of an artist than an engineer. Assuming this is true: What's the problem with that?

The project was not promoted as that for a long time. That "view" on what the project was only came yesterday, when yet another security hole was identified and a patch was prepared.

The impact of that patch would have likely caused actix to no longer be at the top of the techempower benchmarks.

Re: A Sad Day for Rust

#774

Post by steveklabnik »

war1025 wrote: post #673
steveklabnik wrote: post #178

Earlier quoted context omitted.

Integral? No. Used in production, by companies? Yes. Outwardly visible? Absolutely, due to Techempower. Rust will survive without actix, but losing it is a setback for Rust in the web space.

If it's LGPL can't someone just put up a new fork of it and people transition to that?

It is MIT/Apache2, and yes, in theory they can.

Re: A Sad Day for Rust

#775

Post by Traster »

zozbot234 wrote: post #420
Traster wrote: post #254

Earlier quoted context omitted.

That article from Shnatsel is really stunning, just everything about is negative and snarky- to a comical point. His avatar is a cartoon pony doing a facepalm! I find it kind of funny that the author of this has singled out reddit for criticism when seemingly prominent members of the Rust community are perfectly willing to be so openly toxic.

Being negative and snarky about crappy, hacked-together code that might cause security issues all over the place is not a bad thing. Yes, most of the snark there is about 'http' crate with its weird custom implementation of basic data structures.

'Crappy' and 'Hacked-together' are literally just insults, they don't carry real technical criticism and frankly they just continue to undermine the credibility of the author. The fact is that 'crappy' code is the most used http crate by far. Clearly everyone in the rust community must be an idiot to be using it. I'm sure the author went off and wrote a totally safe replacement for it. See, now we all get to be dicks to each other rather than actually working to fix stuff.

Re: A Sad Day for Rust

#776

Post by bpt3 »

AnonymousPlanet wrote: post #730
Uehreka wrote: post #451

Earlier quoted context omitted.

I’d argue that if a company has a larger than normal dependency on keeping a project running (like a cloud provider with 1 million VMs running Debian or Debian-based OSes) they should hire a full time employee whose sole job is to work on it. I think the basic rules still apply: You’re getting this software for free rather than paying for something expensive. Though you deal in the software, you get no guarantee of i…

> You’re getting this software for free rather than paying for something expensive. So open source is free as in beer, not free as in speech after all. And the reason a company might choose to use open source is solely because it's free, not because they can see the source code or alter it? Because that is why companies are in it, not because they were cheap for the small cash of a paid version. And they're in it bec…

> So open source is free as in beer, not free as in speech after all. And the reason a company might choose to use open source is solely because it's free, not because they can see the source code or alter it? Because that is why companies are in it, not because they were cheap for the small cash of a paid version. And they're in it because they can watch and choose those projects that are well maintained.

In general, developers aren't auditing the source code or modifying open source code; they're assembling open source packages to provide base functionality and combining that together with business logic and glue code to produce a product. So yes, companies are most commonly using open source because it's zero cost (and easily available), not because they can theoretically audit or modify it.

> If the maintainer pulls a tantrum and acts unreliable that kills the project from the point of view of any serious user. Until someone else takes over maintenance or it is forked.

There's no single definition of "serious user". There have been projects with no technical issues that are maintained by massive assholes that are widely used, so I would disagree with your statement here.

> This "it's free so you get what you paid for, and if it's shit don't complain because it was free" really rubs me the wrong way. It's a very capitalist mindset that measures everything in money. If there is no money, there is probably no worth, so don't expect any. Accomplishment, dependability, positive net effect? No money, so don't expect it?

1. Unsurprisingly, any discussion within the context of how businesses make decisions or should act is likely to revolve around money.

2. The fundamental issues is that there's a massive disconnect between the worth/value provided by a project to users and the value it provides to the creator.

3. The license dictates what users should expect as far as "what they get" from a library. It almost all cases with open source, they should expect to get nothing, and anything beyond that is a bonus.

Re: A Sad Day for Rust

#777

Post by timjver »

jasonlotito wrote: post #183
jimbokun wrote: post #96

Earlier quoted context omitted.

Ok, so here is the article Klabnik cites, comparing various Rust HTTP clients: https://medium.com/@shnatsel/smoke-testing-rust-http-clients... Skimming this, the author doesn't really like any of them. Note, however, the long list of issues reported at the end of the article. Here is the first one I clicked on: https://github.com/algesten/ureq/issues/24 The maintainer is happy to get the report, and has an exchange w…

You might have missed a couple lines. It's easy to miss as it's right below the quote from the article mentioned: "This causes the now-usual Reddit uproar. It’s extra nasty this time. Some people go far, far, far over the line." The issue isn't the article or the bug reports. It's the uproar from Reddit, and the extra nasty comments. "Some people go far, far, far over the line." There is a reason HN has guidelines fo…

This could very well be thanks to the moderators, but I hardly saw any nasty comments on r/rust. People were critical of the actix maintainer, sure, but I didn't see anything that crossed the line. Some comments in the GitHub issues were indeed nasty, but those were actually called out on the subreddit.

There's no way for me to know for sure, but it seems as though Klabnik was exaggerating here.

Re: A Sad Day for Rust

#778

Post by rafaelvasco »

I don't know the minute details of the case so sorry but this comes to mind:

The double edged sword of open-source: We can't cooperate with one another if we don't know how to behave and deal with other people. Emotion can never have the final say. Because emotion is raw, uncontrolled, knows no boundaries, doesn't know right from wrong. Especially if it is selfish emotion. Those that act like this are bound to harm themselves and others;

Re: A Sad Day for Rust

#779

Post by dunnock »

zozbot234 wrote: post #672
protomyth wrote: post #319

Earlier quoted context omitted.

So, how fast do people expect developers of open source projects to respond before someone is considered unresponsive? I'm not sure combining social media with code control is going to be such a good thing for a lot of developers who might not like to program in a fishbowl.

Expecting a reasonably-quick response to security concerns is certainly appropriate.

That's like expecting your boss to double your salary because he is paying you salary. Opensource expectation should be in general if you are not happy feel free to fork and fix yourself. Then submit PR if you want to push your fix upstream.

But still so many PRs getting rejected, because they do not pass code review and usually it does not cause reporters of those failed PRs to open whole big flame discussion. That + overreaction on reddit was a last drop after which Nikolay decided to close the thing.

Re: A Sad Day for Rust

#780

Post by shkkmo »

tssva wrote: post #494
shkkmo wrote: post #371

Earlier quoted context omitted.

In what way is it correct or even helpful? Even if done tactfully, I have a hard time seeing that being taken by anyone as anything other than a personal attack. The correct response would be to organize the community to create a fork that is more focused on correctness and security than on performance.

It is correct and helpful because it can prevent continued poor behavior which impacts others. Trying to protect someone's feelings only goes so far. Sometimes you have to be straight and to the point with people whether they take it as a personal attack and it hurts their feelings or not. Whether it would be appropriate in this I case I don't know but I disagree that it is never the correct response.

> it can prevent continued poor behavior which impacts others

I highly doubt that it would do anything to prevent that continued behavior. I cannot imagine a situation in which there is not a better and more appropriate solution to mitigating poor behavior that telling people "don't participate in this field". At best you will alienate them in such a manner that alternative approaches are less feasible and at worst you convert bad behavior from being passively to actively malicious. I'd be curious if you have a concrete example for when you think this approach has been beneficial in any context.

Note, I consider revoking credentials (e.g. disbarring an attorney or revoking a medical/engineering license) to be something entirely different as there is an active endorsement that needs to be terminated. Relevancy in this case would be to removing a package from a package/dependency listing service/manager.

Post reply on HN