3 ms·

I think the much bigger issue this spotlights is that many foundation crates are maintained by random third parties and not the rust organization. I think this

I think the much bigger issue this spotlights is that many foundation crates are maintained by random third parties and not the rust organization. I think this will turn into Rust's "leftpad" incident, unless dtolnay rolls back this change soon.

mmastrac 3y ago
dtolnay is not random by far -- he's one of the most influential crate authors in the ecosystem. If anyone is trustworthy enough to pull a stunt like this, it's him. I would challenge you to find more than a half dozen crate authors with more downloads: https://crates.io/users/dtolnay?sort=downloads https://crates.io/users/dtolnay?sort=downloads These are not `leftpad`-level crates. This is fundamental tech in the Rust ecosystem, especially in proc macro work.
- CodesInChaos 3y ago
  > If anyone is trustworthy enough to pull a stunt like this I'd turn this around. If somebody as trusted as him, pulls such a stunt, how are we supposed to trust anybody? > These are not `leftpad`-level crates. They are like leftpad, because they're very popular (indirect) dependencies outside the control of the rust organization.
  - mmastrac 3y ago
    If you find malware in any package he publishes I'll bring out the pitchforks but this drama is all pretty much all hysteria at this point. Calling his contributions leftpad is pretty rude, considering the massive difference between complexity and importance of the two I've only had a handful of interactions with him and he's been a stand-up guy. I'll value the human over the outrage here.
    - martin8412 3y ago
      You're completely misunderstanding what the guy you're responding to is saying. He is not comparing the contributions of the guy to the developers of leftpad. He's saying that the Rust crates system is vulnerable to issues.
    - evilduck 3y ago
      Left-pad was un-published from NPM and broke builds using it. Serde-derive includes unreproducible and unoptional binaries, breaking many builds that prohibit such well trodden attack vectors. What's the difference? Trust is easy to destroy and hard to build. This is trust destroying behavior. There may be some positives that result from this but his reputation may not recover and his motivation for this behavior may not get implemented, it's more likely that cargo just gets updated to block this behavior (good for all of us, but not the intended outcome).

mmastrac 3y ago

dtolnay is not random by far -- he's one of the most influential crate authors in the ecosystem. If anyone is trustworthy enough to pull a stunt like this, it's him. I would challenge you to find more than a half dozen crate authors with more downloads: https://crates.io/users/dtolnay?sort=downloads https://crates.io/users/dtolnay?sort=downloads These are not `leftpad`-level crates. This is fundamental tech in the Rust ecosystem, especially in proc macro work.

CodesInChaos 3y ago
> If anyone is trustworthy enough to pull a stunt like this I'd turn this around. If somebody as trusted as him, pulls such a stunt, how are we supposed to trust anybody? > These are not `leftpad`-level crates. They are like leftpad, because they're very popular (indirect) dependencies outside the control of the rust organization.
- mmastrac 3y ago
  If you find malware in any package he publishes I'll bring out the pitchforks but this drama is all pretty much all hysteria at this point. Calling his contributions leftpad is pretty rude, considering the massive difference between complexity and importance of the two I've only had a handful of interactions with him and he's been a stand-up guy. I'll value the human over the outrage here.
  - martin8412 3y ago
    You're completely misunderstanding what the guy you're responding to is saying. He is not comparing the contributions of the guy to the developers of leftpad. He's saying that the Rust crates system is vulnerable to issues.
  - evilduck 3y ago
    Left-pad was un-published from NPM and broke builds using it. Serde-derive includes unreproducible and unoptional binaries, breaking many builds that prohibit such well trodden attack vectors. What's the difference? Trust is easy to destroy and hard to build. This is trust destroying behavior. There may be some positives that result from this but his reputation may not recover and his motivation for this behavior may not get implemented, it's more likely that cargo just gets updated to block this behavior (good for all of us, but not the intended outcome).