7 ms·

Asking for a friend - could someone explain what happened there? The README doc is quite vague - it is more of a personal justification than a rationale (to me)

by 3jckd 7y ago

Asking for a friend - could someone explain what happened there? The README doc is quite vague - it is more of a personal justification than a rationale (to me).

ealexhudson 7y ago
Sounds like the maintainer writes a lot of code using rust's "unsafe" keyword, and regularly gets issues raised about this (and versioning, and some other bits). This last issue, which included a patch, has pushed them over the edge after it descended into disagreement. Net/net they were repeatedly asked to change coding style, didn't want to, and have decided it's better to just avoid the arguments by not publishing code.
- teddyuk 7y ago
  The maintainer can choose whatever style they damn well please, if you don't like it don't use it. What is hard about this?
  - dsego 7y ago
    Is it a community run project or not? The website seems to imply that the community is welcome to participate: "We're a welcoming community so don't be afraid to engage."
    - zzzcpan 7y ago
      There is no such thing as a community run project. But either way, people told the author to literally stop writing Rust code because he doesn't respect semver. This is not a participation, this is just hate.
    - stjohnswarts 7y ago
      There's a difference between engaging and putting up with raging users
  - logophobia 7y ago
    It's not coding style, it's refusing to investigate use-after-free vulnerabilities in code because it's "boring". Noone should care if a maintainer uses tabs or spaces, or has weird variable naming, but if "coding-style" leads to security issues (due to hand-rolling unsafe memory-primitives), then it is an actual issue, especially if it's for a popular web-framework. Don't like it, don't use it doesn't really apply to security vulnerabilities in such major packages. Flaming and personal attacks are not the solution to this stuff, but this drama feels somewhat self-inflicted.
    - zzzcpan 7y ago
      > it's refusing to investigate use-after-free vulnerabilities Please investigate yourself, don't ask others to do the work you consider important for you for free.
      - Sharlin 7y ago
        The reporter included a patch.
      - jeltz 7y ago
        People did investigate for him and write a patch for him and he dismissed the patch with it being "boring".
        zzzcpan 7y ago
        Well, maybe people didn't provide detailed enough explanation for the author to understand and merge the patch, so he didn't bother.
        jeltz 7y ago
        Judge for yourself: https://web.archive.org/web/20200116203731/https://github.com/actix/actix-net/issues/83 https://web.archive.org/web/20200116203731/https://github.co...
  - hobofan 7y ago
    Civility, apparently. Some people just never "grow up" and/or learn how to treat people with respect, and developers are not special in that regard.
wffurr 7y ago
https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsoundness_patch_is_boring/ https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsou... context for the "boring" patch. Actix is full of "unsafe" blocks and the maintainer got a constant stream of criticism over it.
phoe-krk 7y ago
https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsoundness_patch_is_boring/ https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsou... has more context.
- ufo 7y ago
  The Wayback Machine links don't seem to work anymore, unfortunately.
seren 7y ago
The issue was triggered by someone executing a benchmark on http crates and opening an issue on github, that was then deleted after some heated back and forth. https://www.reddit.com/r/rust/comments/epoloy/ive_smoketested_rust_http_clients_heres_what_i/ https://www.reddit.com/r/rust/comments/epoloy/ive_smoketeste... From the maintainer point of view, it seemed to have been the straw that broke the camel back, but I don't know the whole background. Still seems like a sad story
- lsaferite 7y ago
  Wow. Talk about a bad response though. No matter how abused you may feel as the sole maintainer you should still not throw a tantrum. Censoring an issue title, body, and comments is a gross overreaction. If you want to throw in the towel then just throw in the towel.
stefan_ 7y ago
It seems like the overarching issue is that Rust is a house of cards. They added unsafe like Java has null. My favorite part is that you can declare a crate to forbid unsafe, but that then doesn't have to hold for it's dependencies. The obvious implementation is for unsafe to be infectious like const. You have unsafe code, your crate is unsafe. You depend on an unsafe crate, your crate becomes unsafe.
- beatgammit 7y ago
  I wish there was a better way of handling that in Rust. You should be able to have a few markers in your code: - uses unsafe - no unsafe, but dependencies may use unsafe - no unsafe, no dependencies except the standard library may use unsafe - no unsafe, not even in the standard library uses The current situation is the second one, but many cases probably want the third, and occasionally the fourth. The best part is, this should be fairly easily solved by crates.io upon submission (is there any use of unsafe and are all dependencies marked as strict or more strictly than yours?).
- cesarb 7y ago
  > The obvious implementation is for unsafe to be infectious like const. You have unsafe code, your crate is unsafe. You depend on an unsafe crate, your crate becomes unsafe. That would mean everything is unsafe, since every crate depends on core (or on std which depends on core), which has "unsafe" code. The design of "unsafe" in Rust, instead, is to allow building safe abstractions on top of unsafe code (or be able to clearly mark when the abstraction itself is unsafe). That way, for instance, users of `Vec::push` do not have to worry that it uses uninitialized memory (which is unsafe).
- weavie 7y ago
  That would prevent you from using the stdlib. https://doc.rust-lang.org/src/alloc/string.rs.html#1215-1230 https://doc.rust-lang.org/src/alloc/string.rs.html#1215-1230 Using unsafe doesnt necessarily mean you will have undefined behaviour, it just means you have to think really hard about the behaviour because the compiler won't have your back.
- stjohnswarts 7y ago

by 3jckd 7y ago

Asking for a friend - could someone explain what happened there? The README doc is quite vague - it is more of a personal justification than a rationale (to me).

ealexhudson 7y ago

Sounds like the maintainer writes a lot of code using rust's "unsafe" keyword, and regularly gets issues raised about this (and versioning, and some other bits). This last issue, which included a patch, has pushed them over the edge after it descended into disagreement. Net/net they were repeatedly asked to change coding style, didn't want to, and have decided it's better to just avoid the arguments by not publishing code.

teddyuk 7y ago
The maintainer can choose whatever style they damn well please, if you don't like it don't use it. What is hard about this?
- dsego 7y ago
  Is it a community run project or not? The website seems to imply that the community is welcome to participate: "We're a welcoming community so don't be afraid to engage."
  - zzzcpan 7y ago
    There is no such thing as a community run project. But either way, people told the author to literally stop writing Rust code because he doesn't respect semver. This is not a participation, this is just hate.
  - stjohnswarts 7y ago
    There's a difference between engaging and putting up with raging users
- logophobia 7y ago
  It's not coding style, it's refusing to investigate use-after-free vulnerabilities in code because it's "boring". Noone should care if a maintainer uses tabs or spaces, or has weird variable naming, but if "coding-style" leads to security issues (due to hand-rolling unsafe memory-primitives), then it is an actual issue, especially if it's for a popular web-framework. Don't like it, don't use it doesn't really apply to security vulnerabilities in such major packages. Flaming and personal attacks are not the solution to this stuff, but this drama feels somewhat self-inflicted.
  - zzzcpan 7y ago
    > it's refusing to investigate use-after-free vulnerabilities Please investigate yourself, don't ask others to do the work you consider important for you for free.
    - Sharlin 7y ago
      The reporter included a patch.
    - jeltz 7y ago
      People did investigate for him and write a patch for him and he dismissed the patch with it being "boring".
      - zzzcpan 7y ago
        Well, maybe people didn't provide detailed enough explanation for the author to understand and merge the patch, so he didn't bother.
        jeltz 7y ago
        Judge for yourself: https://web.archive.org/web/20200116203731/https://github.com/actix/actix-net/issues/83 https://web.archive.org/web/20200116203731/https://github.co...
- hobofan 7y ago
  Civility, apparently. Some people just never "grow up" and/or learn how to treat people with respect, and developers are not special in that regard.

wffurr 7y ago

https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsoundness_patch_is_boring/ https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsou... context for the "boring" patch. Actix is full of "unsafe" blocks and the maintainer got a constant stream of criticism over it.

phoe-krk 7y ago

https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsoundness_patch_is_boring/ https://www.reddit.com/r/rust/comments/epszt7/actixnet_unsou... has more context.

ufo 7y ago
The Wayback Machine links don't seem to work anymore, unfortunately.

seren 7y ago

The issue was triggered by someone executing a benchmark on http crates and opening an issue on github, that was then deleted after some heated back and forth. https://www.reddit.com/r/rust/comments/epoloy/ive_smoketested_rust_http_clients_heres_what_i/ https://www.reddit.com/r/rust/comments/epoloy/ive_smoketeste... From the maintainer point of view, it seemed to have been the straw that broke the camel back, but I don't know the whole background. Still seems like a sad story

lsaferite 7y ago
Wow. Talk about a bad response though. No matter how abused you may feel as the sole maintainer you should still not throw a tantrum. Censoring an issue title, body, and comments is a gross overreaction. If you want to throw in the towel then just throw in the towel.

stefan_ 7y ago

It seems like the overarching issue is that Rust is a house of cards. They added unsafe like Java has null. My favorite part is that you can declare a crate to forbid unsafe, but that then doesn't have to hold for it's dependencies. The obvious implementation is for unsafe to be infectious like const. You have unsafe code, your crate is unsafe. You depend on an unsafe crate, your crate becomes unsafe.

beatgammit 7y ago
I wish there was a better way of handling that in Rust. You should be able to have a few markers in your code: - uses unsafe - no unsafe, but dependencies may use unsafe - no unsafe, no dependencies except the standard library may use unsafe - no unsafe, not even in the standard library uses The current situation is the second one, but many cases probably want the third, and occasionally the fourth. The best part is, this should be fairly easily solved by crates.io upon submission (is there any use of unsafe and are all dependencies marked as strict or more strictly than yours?).
cesarb 7y ago
> The obvious implementation is for unsafe to be infectious like const. You have unsafe code, your crate is unsafe. You depend on an unsafe crate, your crate becomes unsafe. That would mean everything is unsafe, since every crate depends on core (or on std which depends on core), which has "unsafe" code. The design of "unsafe" in Rust, instead, is to allow building safe abstractions on top of unsafe code (or be able to clearly mark when the abstraction itself is unsafe). That way, for instance, users of `Vec::push` do not have to worry that it uses uninitialized memory (which is unsafe).
weavie 7y ago
That would prevent you from using the stdlib. https://doc.rust-lang.org/src/alloc/string.rs.html#1215-1230 https://doc.rust-lang.org/src/alloc/string.rs.html#1215-1230 Using unsafe doesnt necessarily mean you will have undefined behaviour, it just means you have to think really hard about the behaviour because the compiler won't have your back.
stjohnswarts 7y ago