3 ms·

Theory that David Tolnay added precompiled serde macros to start a RFC process to add precompiled macros to cargo. Originally the conspiracy was to move Rust to

by Ygg2 3y ago

Theory that David Tolnay added precompiled serde macros to start a RFC process to add precompiled macros to cargo. Originally the conspiracy was to move Rust towards Bazel/Buck. Part of this theory was that he sabotaged thePHD dev's talk in order to force community to rely on his crates `syn`, `quote`, etc. Rather than using Rust to maintain guarantees. I mean who doesn't like working (mostly) unpaid for open source community in order to maintain Clout™?

epage 3y ago
> Originally the conspiracy was to move Rust towards Bazel/Buck. Never saw this part of the conversation and hope no one took my words to mean I felt that. I only expressed regret that he (a Project member and maintainer of one of the more critical packages) gave up on cargo wich I surmised by him saying that he did work for buck/bazel but didn't do anything for cargo but dumped the binary on us.
- Ygg2 3y ago
  You might not have meant it, but people on Reddit/Discord, in a dysmal show of game of telephones thought it was a credible theory.
  - epage 3y ago
    Huh, somehow I missed that bit on reddit. As for Discord, I tend to keep my interactions there to a minimum, so not suprised that I missed that.
lexlash 3y ago
I don’t think it’s a theory. He certainly tried to use the precompiled macros in service of this pre-RFC: https://internals.rust-lang.org/t/pre-rfc-sandboxed-deterministic-reproducible-efficient-wasm-compilation-of-proc-macros/19359 https://internals.rust-lang.org/t/pre-rfc-sandboxed-determin... Relevant section: "Someone else is always auditing the code and will save me from anything bad in a macro before it would ever run on my machines." (At one point serde_derive ran an untrusted binary for over 4 weeks across 12 releases before almost anyone became aware. This was plain-as-day code in the crate root; I am confident that professionally obfuscated malicious code would be undetected for years.)
- nextaccountic 3y ago
  > I am confident that professionally obfuscated malicious code would be undetected for years There was even a contest for underhanded code (malicious code that, if found, someone could plausibly claim that it was just a honest programmer mistake rather than intentional malware), it was pretty cool https://www.reddit.com/r/rust/comments/72v194/the_2016_underhanded_rust_contest_the_results/ https://www.reddit.com/r/rust/comments/72v194/the_2016_under... And there were talks to revive it https://github.com/rust-community/team/issues/256 https://github.com/rust-community/team/issues/256

by Ygg2 3y ago

epage 3y ago

> Originally the conspiracy was to move Rust towards Bazel/Buck. Never saw this part of the conversation and hope no one took my words to mean I felt that. I only expressed regret that he (a Project member and maintainer of one of the more critical packages) gave up on cargo wich I surmised by him saying that he did work for buck/bazel but didn't do anything for cargo but dumped the binary on us.

Ygg2 3y ago
You might not have meant it, but people on Reddit/Discord, in a dysmal show of game of telephones thought it was a credible theory.
- epage 3y ago
  Huh, somehow I missed that bit on reddit. As for Discord, I tend to keep my interactions there to a minimum, so not suprised that I missed that.

lexlash 3y ago

I don’t think it’s a theory. He certainly tried to use the precompiled macros in service of this pre-RFC: https://internals.rust-lang.org/t/pre-rfc-sandboxed-deterministic-reproducible-efficient-wasm-compilation-of-proc-macros/19359 https://internals.rust-lang.org/t/pre-rfc-sandboxed-determin... Relevant section: "Someone else is always auditing the code and will save me from anything bad in a macro before it would ever run on my machines." (At one point serde_derive ran an untrusted binary for over 4 weeks across 12 releases before almost anyone became aware. This was plain-as-day code in the crate root; I am confident that professionally obfuscated malicious code would be undetected for years.)

nextaccountic 3y ago
> I am confident that professionally obfuscated malicious code would be undetected for years There was even a contest for underhanded code (malicious code that, if found, someone could plausibly claim that it was just a honest programmer mistake rather than intentional malware), it was pretty cool https://www.reddit.com/r/rust/comments/72v194/the_2016_underhanded_rust_contest_the_results/ https://www.reddit.com/r/rust/comments/72v194/the_2016_under... And there were talks to revive it https://github.com/rust-community/team/issues/256 https://github.com/rust-community/team/issues/256