4 ms·

I generally believe people should be polite. But when you open source a project, you are opening yourself up to criticism and critique of your work. You are op

I generally believe people should be polite. But when you open source a project, you are opening yourself up to criticism and critique of your work. You are opening yourself up to that in basically any form the internet wants to take it, and sometimes that really can be shitty. We have a very promising project making use of a language that has gained popularity largely based on marketing around memory safety, and then that project has unnecessary and flawed use of something that undermines the messaging around rust. This is a risk for Rust - a promising and popular project in a popular space that undermines some of the core rust messaging is a PR problem for the language. The maintainer not being receptive to contributions to resolve this difference is a problem. The maintainer not being receptive to contributions that fix SECURITY ISSUES is a MAJOR problem. Open source maintainers are, of course, volunteers. I don't think we should hold them responsible for the fact that there are bugs in their code, or even security flaws. People aren't perfect, and no one should be expected to be, especially when contributing something to the open source community. But we SHOULD hold them responsible for not fixing security issues. It's irresponsible to release something to the public that you know puts them at risk. So is it fair for people to be upset in this situation? I think so. I also think their reaction should be a polite one - but it's totally fair for people to push someone to take responsibility for code they've introduced to the world that has security vulnerabilities in it.

bloodorange 7y ago
Exactly! Everyone should demand a full cash refund for all that they paid for the maintenance of that piece of software.
- cthalupa 7y ago
  This is a common snarky retort when any discussion happens with open source software, but it doesn't add anything to the discussion. There is a cost to using software that goes beyond money exchanging hands. The maintainer has no legal obligation to do anything, but acting as if someone having an issue with software having security vulnerabilities is someone being entitled is a childish reduction of the interactions in play here, especially when people are taking the time to write code that resolves the issue.
  - bloodorange 7y ago
    Why do you think it adds no value? It at least makes it very clear to those who have not paid for the maintenance that their position is silly if they make demands of the maintainer. It is his project and he does as he pleases. Why is that difficult to see? One could perhaps persuade him to accept a patch but like any endeavour where you need something from another person, either you offer them something in exchange (which they value enough) or ask nicely and see how it goes. In either case, it might still fail. In that case, one can of course try and do the same with _someone else_ who might be more receptive. This is possible with free/open-source software. What you consider a "snarky retort" is just the same thing said in a different tone.
rjbwork 7y ago
I disagree, actually. There are no expectations of anyone that releases their code under most licenses. You get to use it as is, and if you want to change it, you submit a patch. Totally up to them if they want to take it or not. If the current maintainer isn't doing what you, or "the community" wants, you fork and make the changes you want to see, and maybe eventually work with a group of people. Maintainers are under absolutely zero obligation to the people who choose to use the code, unless they've specified as such in the license or some other contract. It's the only thing that lets FOSS software be a thing in the first place.
- cthalupa 7y ago
  I'm not arguing they are under any legal obligation, but holding people responsible for something doesn't have to be a legal thing. I feel that any open source software that I have released I have a moral obligation to fix any security issues, or if I am unable to for some reason, clearly stating that they exist. It is irresponsible to leave your software available with a known security issue.

bloodorange 7y ago

Exactly! Everyone should demand a full cash refund for all that they paid for the maintenance of that piece of software.

cthalupa 7y ago
This is a common snarky retort when any discussion happens with open source software, but it doesn't add anything to the discussion. There is a cost to using software that goes beyond money exchanging hands. The maintainer has no legal obligation to do anything, but acting as if someone having an issue with software having security vulnerabilities is someone being entitled is a childish reduction of the interactions in play here, especially when people are taking the time to write code that resolves the issue.
- bloodorange 7y ago
  Why do you think it adds no value? It at least makes it very clear to those who have not paid for the maintenance that their position is silly if they make demands of the maintainer. It is his project and he does as he pleases. Why is that difficult to see? One could perhaps persuade him to accept a patch but like any endeavour where you need something from another person, either you offer them something in exchange (which they value enough) or ask nicely and see how it goes. In either case, it might still fail. In that case, one can of course try and do the same with _someone else_ who might be more receptive. This is possible with free/open-source software. What you consider a "snarky retort" is just the same thing said in a different tone.

rjbwork 7y ago

I disagree, actually. There are no expectations of anyone that releases their code under most licenses. You get to use it as is, and if you want to change it, you submit a patch. Totally up to them if they want to take it or not. If the current maintainer isn't doing what you, or "the community" wants, you fork and make the changes you want to see, and maybe eventually work with a group of people. Maintainers are under absolutely zero obligation to the people who choose to use the code, unless they've specified as such in the license or some other contract. It's the only thing that lets FOSS software be a thing in the first place.

cthalupa 7y ago
I'm not arguing they are under any legal obligation, but holding people responsible for something doesn't have to be a legal thing. I feel that any open source software that I have released I have a moral obligation to fix any security issues, or if I am unable to for some reason, clearly stating that they exist. It is irresponsible to leave your software available with a known security issue.