5 ms·

Isn't that author kind of prolific within the rust library world? He didn't do that to any other libraries. Is there something with more info?

by tayo42 3y ago

steveklabnik 3y ago
Yes. The release notes for the last release explain: https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34
- empath-nirvana 3y ago
  That is incredibly obnoxious and irresponsible and he should turn over the repo to someone else to manage.
  - ahahahahah 3y ago
    No, it's incredibly irresponsible to hand over the repo to someone else to manage, even someone who is an active contributor. See https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... for example.
  - steveklabnik 3y ago
    I’m not sure how much open source work you’ve done or what packages you’ve maintained, but in my experience, the “someone else” rarely ever comes. Heck I have even been the someone else and then done a bad job of it! This is an unrealistic and frankly a bit entitled of a criticism. This is before we even get to stuff like “it’s not like yaml is a fast moving target, what continued maintenance is really even needed” parts of the equation, or the comment above that said he’s tried already.
    - curun1r 3y ago
      The “someone else” also needs to be vetted to ensure that their first update won’t include crypto mining malware. We should remember that an unmaintained dependency isn’t the worst thing that can happen to a supply chain. There are far worse nightmare scenarios that involve exfiltrated keys, ransomewared files and such. I’ll bet that if someone with a track record of contributing to the Rust community steps up, he’ll happily transfer control of the crate. But he’s not just going to assign it to some random internet user and put the whole ecosystem at risk.
  - uh_uh 3y ago
    What's so irresponsible about it? He clearly communicated the state of affairs. I think he was generous enough with his time for creating the library in the first place and posting this update. It's not like he's owing anything to anybody. I don't understand how you can demand him to do further UNPAID work to recruit maintainers who would also do further unpaid work.
  - foverzar 3y ago
    > he should turn over the repo to someone else to manage Why can't this "someone else" just fork the repo themselves?
  - keybored 3y ago
    Anyone else is free to take it! You see that the repository is hosted under his own user. Anyone else can create an organization or host it under their own name. Are we collectively having Subversion phantom pains or something? Just take it.
  - shrimp_emoji 3y ago
    The obnoxious and irresponsible part is the hubris of thinking you can have a package repository system that's going to not have problems like this and left-pad. You can't. Ever. This is unironically why languages too old for package repositories like C and C++ lend themselves to stabler, higher-quality software. On top of that is also the entitlement to feel like people providing you software for free MUST ALSO be responsible for polishing it forever. But, hey, I guess that attitude comes naturally with the package repository mindset. ;D People need to do all my work for me!
    - iknowstuff 3y ago
      > C and C++ > stabler, higher-quality software. Lol I’ll have some too buddy
  - switch007 3y ago
    With the greatest respect, I think it is your attitude that needs adjustment, not their behaviour.
  - tcmart14 3y ago
    I believe he offered for someone to take over and no one ever stepped up to the plate. This happens a lot.
IshKebab 3y ago
I found an explanation. Reading between the lines I think he found something less abysmal than YAML. https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 > As of this release, I am not planning to publish further versions of serde_yaml as none of my projects have been using YAML for a long time, so I have archived the GitHub repo and marked the crate deprecated in the version number.
- rob74 3y ago
  Hm... might still have been better to first ask around if anyone is willing to maintain it instead of marking it as deprecated?
  - the_mitsuhiko 3y ago
    From what I can tell this is a second order effect. No advisory was made against serde-yaml, it was made against rust-yaml. The maintainer of serde-yaml I believe just took the opportunity to mark it as deprecated to ensure people don't migrate there.
    - geodel 3y ago
      I'd think of it as a smart move considering how entitled, aggressive and demanding open source software users have become over maintainers.
      - tempaccount420 3y ago
        Yeah, I'm really disappointed reading the comments here. This is his project, he can do whatever he wants with it, including delete and forget about it. The author doesn't owe you anything. Just use a fork or another implementation. This isn't the end of the world.
        IshKebab 3y ago
        > The author doesn't owe you anything. I don't think anyone is claiming he is legally required to do it. Just that it would be nice. But in this case I think he did try to look for someone anyway.
SAI_Peregrinus 3y ago
AFAIK he'd been looking for a maintainer for this for a while, didn't find one, and so just marked it unmaintained. He's not doing it, nobody else wanted to, so it'd be irresponsible to leave it listed as maintained.
pie_flavor 3y ago
He does this all the time to libraries. These things are correlated; the more tools you make, the less time you have to maintain any single one of them. You learn to ignore it because they're also extremely well made libraries where the unmaintained status doesn't mean anything.

Isn't that author kind of prolific within the rust library world? He didn't do that to any other libraries. Is there something with more info?

by tayo42 3y ago

Isn't that author kind of prolific within the rust library world? He didn't do that to any other libraries. Is there something with more info?

steveklabnik 3y ago

Yes. The release notes for the last release explain: https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34

empath-nirvana 3y ago
That is incredibly obnoxious and irresponsible and he should turn over the repo to someone else to manage.
- ahahahahah 3y ago
  No, it's incredibly irresponsible to hand over the repo to someone else to manage, even someone who is an active contributor. See https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... for example.
- steveklabnik 3y ago
  I’m not sure how much open source work you’ve done or what packages you’ve maintained, but in my experience, the “someone else” rarely ever comes. Heck I have even been the someone else and then done a bad job of it! This is an unrealistic and frankly a bit entitled of a criticism. This is before we even get to stuff like “it’s not like yaml is a fast moving target, what continued maintenance is really even needed” parts of the equation, or the comment above that said he’s tried already.
  - curun1r 3y ago
    The “someone else” also needs to be vetted to ensure that their first update won’t include crypto mining malware. We should remember that an unmaintained dependency isn’t the worst thing that can happen to a supply chain. There are far worse nightmare scenarios that involve exfiltrated keys, ransomewared files and such. I’ll bet that if someone with a track record of contributing to the Rust community steps up, he’ll happily transfer control of the crate. But he’s not just going to assign it to some random internet user and put the whole ecosystem at risk.
- uh_uh 3y ago
  What's so irresponsible about it? He clearly communicated the state of affairs. I think he was generous enough with his time for creating the library in the first place and posting this update. It's not like he's owing anything to anybody. I don't understand how you can demand him to do further UNPAID work to recruit maintainers who would also do further unpaid work.
- foverzar 3y ago
  > he should turn over the repo to someone else to manage Why can't this "someone else" just fork the repo themselves?
- keybored 3y ago
  Anyone else is free to take it! You see that the repository is hosted under his own user. Anyone else can create an organization or host it under their own name. Are we collectively having Subversion phantom pains or something? Just take it.
- shrimp_emoji 3y ago
  The obnoxious and irresponsible part is the hubris of thinking you can have a package repository system that's going to not have problems like this and left-pad. You can't. Ever. This is unironically why languages too old for package repositories like C and C++ lend themselves to stabler, higher-quality software. On top of that is also the entitlement to feel like people providing you software for free MUST ALSO be responsible for polishing it forever. But, hey, I guess that attitude comes naturally with the package repository mindset. ;D People need to do all my work for me!
  - iknowstuff 3y ago
    > C and C++ > stabler, higher-quality software. Lol I’ll have some too buddy
- switch007 3y ago
  With the greatest respect, I think it is your attitude that needs adjustment, not their behaviour.
- tcmart14 3y ago
  I believe he offered for someone to take over and no one ever stepped up to the plate. This happens a lot.

IshKebab 3y ago

I found an explanation. Reading between the lines I think he found something less abysmal than YAML. https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 > As of this release, I am not planning to publish further versions of serde_yaml as none of my projects have been using YAML for a long time, so I have archived the GitHub repo and marked the crate deprecated in the version number.

rob74 3y ago
Hm... might still have been better to first ask around if anyone is willing to maintain it instead of marking it as deprecated?
- the_mitsuhiko 3y ago
  From what I can tell this is a second order effect. No advisory was made against serde-yaml, it was made against rust-yaml. The maintainer of serde-yaml I believe just took the opportunity to mark it as deprecated to ensure people don't migrate there.
  - geodel 3y ago
    I'd think of it as a smart move considering how entitled, aggressive and demanding open source software users have become over maintainers.
    - tempaccount420 3y ago
      Yeah, I'm really disappointed reading the comments here. This is his project, he can do whatever he wants with it, including delete and forget about it. The author doesn't owe you anything. Just use a fork or another implementation. This isn't the end of the world.
      - IshKebab 3y ago
        > The author doesn't owe you anything. I don't think anyone is claiming he is legally required to do it. Just that it would be nice. But in this case I think he did try to look for someone anyway.

SAI_Peregrinus 3y ago

AFAIK he'd been looking for a maintainer for this for a while, didn't find one, and so just marked it unmaintained. He's not doing it, nobody else wanted to, so it'd be irresponsible to leave it listed as maintained.

pie_flavor 3y ago

He does this all the time to libraries. These things are correlated; the more tools you make, the less time you have to maintain any single one of them. You learn to ignore it because they're also extremely well made libraries where the unmaintained status doesn't mean anything.