3 ms·

Seems a justified policy for a compiler. If you are distributing a patched version of a compiler that is not from upstream you absolutely need to make users awa

Seems a justified policy for a compiler. If you are distributing a patched version of a compiler that is not from upstream you absolutely need to make users aware of that fact, so that they can decide whether they want to trust you or not. It is a security issue, because the effects of using a broken compiler can go beyond one machine. Also, Rust needs some legal mechanism to shut down malware. Otherwise someone could throw up a build of "Rust" that does bad things to compile products and they would have no legal recourse to shut that down.

im3w1l 4y ago
A busted compiler is no more serious than a busted kernel, or busted shell. And yet so many shells can provide /bin/sh. Good thing or my shebang would have to be customized a million times for different people.
Nextgrid 4y ago
> Otherwise someone could throw up a build of "Rust" that does bad things to compile products and they would have no legal recourse to shut that down. If someone is distributing malicious software, 1) I don’t think they care about whether anyone has legal recourse to stop them, partly because 2) they’ve already taken steps to become anonymous and resist takedowns.
weare138 4y ago
It's odd to try and enforce something like this through something as broad as a copyright clause on an open-source project. If it was restricted to commercial distributions of Rust a copyright restriction would make sense. Consumers could be confused into thinking it was officially connected to or endorsed by the Rust project which is really what copyright violations come down to legally. Debian is open-source, open about the patches it applies and not in any way purporting it's the 'official' upstream Rust distribution or the patches are official upstream patches. I don't see how someone could make the argument the Debian project is somehow legally acting in bad faith with intent in a way that could either confuse consumers or cause financial damage and/or harm the Rust projects reputation. To me claims like this just set a bad precedence in the open-source software ecosystem. The broadness of the clause has serious potential for abuse. It seems like a way to leverage the benefits of the open-source community while still protecting IP through copyright claims. That's how we ended up with the Oracle/Java debacle. Don't get me wrong I'm not saying the Rust project is just flat out evil like Oracle but the potential for abuse is there and definitely not in the spirit or intention of open-source software.

im3w1l 4y ago

A busted compiler is no more serious than a busted kernel, or busted shell. And yet so many shells can provide /bin/sh. Good thing or my shebang would have to be customized a million times for different people.

Nextgrid 4y ago

> Otherwise someone could throw up a build of "Rust" that does bad things to compile products and they would have no legal recourse to shut that down. If someone is distributing malicious software, 1) I don’t think they care about whether anyone has legal recourse to stop them, partly because 2) they’ve already taken steps to become anonymous and resist takedowns.

weare138 4y ago

It's odd to try and enforce something like this through something as broad as a copyright clause on an open-source project. If it was restricted to commercial distributions of Rust a copyright restriction would make sense. Consumers could be confused into thinking it was officially connected to or endorsed by the Rust project which is really what copyright violations come down to legally. Debian is open-source, open about the patches it applies and not in any way purporting it's the 'official' upstream Rust distribution or the patches are official upstream patches. I don't see how someone could make the argument the Debian project is somehow legally acting in bad faith with intent in a way that could either confuse consumers or cause financial damage and/or harm the Rust projects reputation. To me claims like this just set a bad precedence in the open-source software ecosystem. The broadness of the clause has serious potential for abuse. It seems like a way to leverage the benefits of the open-source community while still protecting IP through copyright claims. That's how we ended up with the Oracle/Java debacle. Don't get me wrong I'm not saying the Rust project is just flat out evil like Oracle but the potential for abuse is there and definitely not in the spirit or intention of open-source software.