3 ms·

> If anyone is trustworthy enough to pull a stunt like this I'd turn this around. If somebody as trusted as him, pulls such a stunt, how are we supposed to tru

• mmastrac 3y ago
  If you find malware in any package he publishes I'll bring out the pitchforks but this drama is all pretty much all hysteria at this point. Calling his contributions leftpad is pretty rude, considering the massive difference between complexity and importance of the two I've only had a handful of interactions with him and he's been a stand-up guy. I'll value the human over the outrage here.
  • martin8412 3y ago
    You're completely misunderstanding what the guy you're responding to is saying. He is not comparing the contributions of the guy to the developers of leftpad. He's saying that the Rust crates system is vulnerable to issues.
  • evilduck 3y ago
    Left-pad was un-published from NPM and broke builds using it. Serde-derive includes unreproducible and unoptional binaries, breaking many builds that prohibit such well trodden attack vectors. What's the difference? Trust is easy to destroy and hard to build. This is trust destroying behavior. There may be some positives that result from this but his reputation may not recover and his motivation for this behavior may not get implemented, it's more likely that cargo just gets updated to block this behavior (good for all of us, but not the intended outcome).