5 ms·

I loved your policy and appreciated how principled it was. People here are too harsh and most of them don't write code in Rust where regular updates are much mo

by jzoch 5y ago

I loved your policy and appreciated how principled it was. People here are too harsh and most of them don't write code in Rust where regular updates are much more the norm than other communities.

richardwhiuk 5y ago
Yanking releases which have bugs / vulnerabilities in them is very much not the norm in the Rust community. This is why projects like https://github.com/RustSec https://github.com/RustSec exist.
- steveklabnik 5y ago
  I don't know about that, crates that RustSec has advisories for are often yanked, in my experience. Bugs? No. Security bugs? Yes.
  - richardwhiuk 5y ago
    Hyper 0.11.26 - https://crates.io/crates/hyper/0.11.26 https://crates.io/crates/hyper/0.11.26 Not yanked. Vulnerable to https://github.com/RustSec/advisory-db/blob/main/crates/hyper/RUSTSEC-2020-0008.md https://github.com/RustSec/advisory-db/blob/main/crates/hype...
    - steveklabnik 5y ago
      Sure, it's quite possible that not every single one ever is. One single version of one single library not being yanked doesn't mean that nobody ever does it.