911–920 of 1001 posts
Earlier quoted context omitted.
Integral? No. Used in production, by companies? Yes. Outwardly visible? Absolutely, due to Techempower. Rust will survive without actix, but losing it is a setback for Rust in the web space.
If it's LGPL can't someone just put up a new fork of it and people transition to that?
I've written a lot of Rust code that's in production in web, messaging and telephony contexts. I considered using Actix early on, but as soon as I saw the large amount of unsafe code, I stopped considering it at all. I did not go on the Internet and try to convince other people not to use it. I did not complain at the maintainer that he should manage his project differently. I just didn't see why a library doing what…
as soon as I saw the large amount of unsafe code, I stopped considering it at all So in that case you wouldn’t use any software written in plain C, right?
Earlier quoted context omitted.
I didn't think it could be so difficult to separate legal contracts from social ones. If you have voluntarily assumed the role of maintaining an open source project, it's perfectly reasonable for people to expect you to address merge requests and issues on the issue tracker. It's reasonable to expect a maintainer to process technical arguments and justify their technical decisions. The maintainer of course has no leg…
Legal statements aren't special. They are also plain old social statements, which I think was his point. It's not solely a "don't sue me".
Thus, the disclaimer in the license cannot double as a disclaimer in the social arena.
Earlier quoted context omitted.
Maybe that is what the developer intended, but afaik it is not what he communicated. What he communicated was a flat out dismissal of the issue along with the proposed fixes. Followed by deleting the whole issue from GitHub. To be fair, there were some very unpleasant things said in there, but he could have just deleted those and maybe locked the conversation telling people about his plans. This whole thing was a fee…
So, how fast do people expect developers of open source projects to respond before someone is considered unresponsive? I'm not sure combining social media with code control is going to be such a good thing for a lot of developers who might not like to program in a fishbowl.
If he'd said "I'll write my own solution" rather than calling it boring, his response wouldn't have been a problem.
Earlier quoted context omitted.
It must depend on the project in ways I don't understand. Certainly while working on Firefox I saw tons of toxic behavior from users, and sometimes potential contributors. I've seen it in lots of other projects that I haven't worked on. But for rr (4.7K Github stars) I have seen none whatsoever. I wish I could explain the difference, but I can't.
rr is only useful to people with a minimal level of knowledge, and in most cases to people who have stood in your shoes. Firefox is useful to any six-year-old with a cellphone. Maybe that explains the difference.
I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project. No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Of course, you could…
> you either be receptive to security concerns or you clearly label your project as a toy project. Or, assume all OSS projects are toy projects unless stated otherwise. Usually the serious ones offer a support license for a fee, or are supported financially by companies. Otherwise, it's just someone building cool stuff for free. Also, it's probably fair that most OSS maintainers aren't marketing their projects too ag…
Earlier quoted context omitted.
As a maintainer, I treat almost all PR submission with kind words. What actix developer did was, to pardon my French, inexcusable. Deeming security patch boring? Making your own `Cell`, implementing it badly and misusing it, because it's faster on some stupid benchmark site? If we designed cars like that, they would have no breaks, no gears and no cabin. Honestly, I think it's better Rust abandons `actix` asap. Befor…
The "boring" was in response to the comment above it, which was discussing if the patch is large enough to merit a statement that they are contributing under the projects license. The patch was "boring", not substantial to claim copyright.
https://gist.github.com/pcr910303/d7722a26499d0e9d2f9034a06f...
Earlier quoted context omitted.
What do you use now? Warp?
Right now, if you want async/await, you either have warp or tide. Hopefully gotham or rocket gets around to updating.
Earlier quoted context omitted.
>People could have forked and worked on the issues themselves, but that's asking too much. Forking projects should be a last resort. This is the "Taking my ball and going home" approach, and now we're splitting development efforts, potentially ending up with very different code paths where improvements can't be merged from one to another, etc. It might be the right thing to do in this situation - but people wanting t…
> Forking projects should be a last resort No. This was kind of true in the days of CVS and SVN. Now with DVCSs like Git, it's easy enough to merge in changes from wherever; this was the whole reason Tom Lord originally developed the modern DVCS. Git workflows commonly make a new fork for every bug fix. If other people don't want to merge in your changes, they probably don't think they're good enough. But that doesn'…
Shouldn't that be Larry McVoy? BitKeeper predated GNU Arch by a couple years.
This seems to be a case of mismatched expectations. Many want Rust to save us from our current nightmare hellscape of vulnerability-ridden foundations. So actix-web comes along-- a Rust web framework that is faster than everything else including the C and C++ frameworks-- and people are filled with hope. It's fast and safe, right? But the actix-web maintainer says he built actix-web just for fun and to see how high h…