4 ms·

To start: any personal attacks against the author are unacceptable. Anyone is free to write whatever the code in Rust they like, and it is wrong to attack them

by dpc_pw 7y ago

To start: any personal attacks against the author are unacceptable. Anyone is free to write whatever the code in Rust they like, and it is wrong to attack them about it. But .... I think it is showing that the premise of memory safety in Rust is working. Stuff that would go unnoticed in C and C++, is being identified and called out in Rust. Does it lead to drama, personal conflicts, etc.? Maybe. But from the perspective of the potential Rust user it's a proof that it `unsafe` keyword works, leads to higher scrutiny of potentially dangerous patterns and that the culture of other Rust users takes reliability, security and safety seriously.

einpoklum 7y ago
> Anyone is free to write whatever the code in Rust they like Let's take an extreme example: I write some program for common use and intentionally introduce a security hole or make it participate in bot-nets. And don't tell anyone about it. Am I "free to write it because I like it"? Well, in some sense, maybe, but it would also be something extremely problematic for me to do. Certainly everyone would scream bloody murder when it gets found out. So, in a less extreme example, there's still some measure of responsibility of mapping out what and how you've vetted, and not making false claims.
- clarry 7y ago
  I think if you're actively deploying malware that people will run, the case is pretty clear. And when you say "for common use", it sound like you know that it is or intend it to be distributed and run by many people. What's less clear is security holes (which are not malware as such) or just "putting code out there" ("not in common use", although someone could come and pick it up and start using it). I would defend your right to write exploits and backdoors and bots and put them on github. Simply making a security hole is IMHO OK unless you have intent to exploit it (or let someone who intends to exploit it know about it). The difference, for me, is in writing versus deploying. And I'd consider it deploying if you intentionally post malware to a public repo you know people will run (without knowledge of having malware in it). Contrast with building a trap (and maybe showing it to people) and stashing it in shed, versus building a trap and priming it and putting it in the woods where you know kids like to play. Not a watertight analogy, I guess making traps could be illegal just like making guns is in many countries. But you get the idea. I think you should be allowed to write malware or make combat knives or mantraps for fun but don't put them to their respective use. Of course, going down this line of reasoning is a rabbit hole. If you build something on your yard (something that isn't illegal per se and has no intention to harm anyone) and it turns out to be dangerous and someone gets hurt, you might have to take responsibility (but it really depends on a lot of factors and would be decided on a case by case basis). I'm not sure I would like such reasoning to be applied to FLOSS projects that come with a warranty disclaimer and which can freely be audited by anyone who intends to use them for real. It's not like they hurt you just because you happened to stumble upon them.

by dpc_pw 7y ago

einpoklum 7y ago

> Anyone is free to write whatever the code in Rust they like Let's take an extreme example: I write some program for common use and intentionally introduce a security hole or make it participate in bot-nets. And don't tell anyone about it. Am I "free to write it because I like it"? Well, in some sense, maybe, but it would also be something extremely problematic for me to do. Certainly everyone would scream bloody murder when it gets found out. So, in a less extreme example, there's still some measure of responsibility of mapping out what and how you've vetted, and not making false claims.

clarry 7y ago
I think if you're actively deploying malware that people will run, the case is pretty clear. And when you say "for common use", it sound like you know that it is or intend it to be distributed and run by many people. What's less clear is security holes (which are not malware as such) or just "putting code out there" ("not in common use", although someone could come and pick it up and start using it). I would defend your right to write exploits and backdoors and bots and put them on github. Simply making a security hole is IMHO OK unless you have intent to exploit it (or let someone who intends to exploit it know about it). The difference, for me, is in writing versus deploying. And I'd consider it deploying if you intentionally post malware to a public repo you know people will run (without knowledge of having malware in it). Contrast with building a trap (and maybe showing it to people) and stashing it in shed, versus building a trap and priming it and putting it in the woods where you know kids like to play. Not a watertight analogy, I guess making traps could be illegal just like making guns is in many countries. But you get the idea. I think you should be allowed to write malware or make combat knives or mantraps for fun but don't put them to their respective use. Of course, going down this line of reasoning is a rabbit hole. If you build something on your yard (something that isn't illegal per se and has no intention to harm anyone) and it turns out to be dangerous and someone gets hurt, you might have to take responsibility (but it really depends on a lot of factors and would be decided on a case by case basis). I'm not sure I would like such reasoning to be applied to FLOSS projects that come with a warranty disclaimer and which can freely be audited by anyone who intends to use them for real. It's not like they hurt you just because you happened to stumble upon them.