3 ms·
> it's refusing to investigate use-after-free vulnerabilities Please investigate yourself, don't ask others to do the work you consider important for you for f
by zzzcpan 7y ago
> it's refusing to investigate use-after-free vulnerabilities
Please investigate yourself, don't ask others to do the work you consider important for you for free.
- Sharlin 7y agoThe reporter included a patch.
- jeltz 7y agoPeople did investigate for him and write a patch for him and he dismissed the patch with it being "boring".
- zzzcpan 7y agoWell, maybe people didn't provide detailed enough explanation for the author to understand and merge the patch, so he didn't bother.
- jeltz 7y agoJudge for yourself: https://web.archive.org/web/20200116203731/https://github.com/actix/actix-net/issues/83 https://web.archive.org/web/20200116203731/https://github.co...
- ryandrake 7y agoIt seems like the better solution here would have been for the folks who wanted a fixed version of the software to create and maintain a "actix-done-right" fork themselves. This is what we all do in the professional world when a maintainer doesn't want to upstream critical patches for whatever reason. They're under no obligation to upstream your patch, but it's open source so you're not powerless either! Why so much drama over a rejected PR?
- XelNika 7y agoCreating a fork is generally not the optimal solution. Both current and future users benefit from a patch, only those that hear about it benefit from a fork. Now, in a case like this where the maintainer won't accept patches, yes, fork and move on would have been better.