3 ms·
Author here. What they did wrong was making promises to users and then breaking those promises. I also tried to make the case that they either did not do thei
by ghoward 6y ago
Author here.
What they did wrong was making promises to users and then breaking those promises.
I also tried to make the case that they either did not do their due diligence, which they should have done because they used C in the first place, or they did and should not have given up that battle-tested code.
I even mentioned that they were victims of the Rust language not keeping its promises. So I disagree that I am blaming the victim here.
Also, if they did not want to do the due diligence required by using C, they should have written Cryptography in Rust from the beginning and not made promises to users that they couldn't keep.
- tptacek 6y agoRust was not a viable option when pyca/cryptography was first released. You should be more familiar with projects before you invent strange promises you feel they've made to you.
- ghoward 6y agoI made the argument knowing that, actually. And in my opinion, the promises are almost always implicit.
- tptacek 6y agoNo, after re-reading your piece, I don't think you did.
- ghoward 6y agoThen I guess I made the argument poorly and still need practice writing for an audience.
- tptacek 6y agoA good start would have been acknowledging that flaw in your premise, anywhere in the piece. It's an unsalvageable argument regardless; you have invented a promise nobody made to you, compelling strangers to manage a project in which you have no involvement to conduct their work in accordance with your wishes.
- ghoward 6y agoI don't know why I can't reply to your reply, so I'll post it here. My argument is that Rust _still_ isn't ready for the Cryptography library because it's not portable enough. And I am not a direct user of the Cryptography library. I am an indirect user on x86_64, so I am unaffected. They have kept their implicit promise to me.
- pjmlp 6y agoThe only people that can be pissed off by promises are paying customers. So those paying to Cryptography developers, are the ones to be pissed off, IF their platforms aren't being considered.
- ghoward 6y agoDoes that include the customers of https://fishinabarrel.github.io/ https://fishinabarrel.github.io/, the company owned by one of the Cryptography developers?
- pjmlp 6y agoYes, assuming they are paying for it and are not able to use it on the use cases they are paying for. Then again, they clearly mention on that page: " Please put us out of business. Stop writing C/C++. Probably you should also sandbox your software. "