4 ms·

That is incredibly obnoxious and irresponsible and he should turn over the repo to someone else to manage.

ahahahahah 3y ago
No, it's incredibly irresponsible to hand over the repo to someone else to manage, even someone who is an active contributor. See https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... for example.
steveklabnik 3y ago
I’m not sure how much open source work you’ve done or what packages you’ve maintained, but in my experience, the “someone else” rarely ever comes. Heck I have even been the someone else and then done a bad job of it! This is an unrealistic and frankly a bit entitled of a criticism. This is before we even get to stuff like “it’s not like yaml is a fast moving target, what continued maintenance is really even needed” parts of the equation, or the comment above that said he’s tried already.
- curun1r 3y ago
  The “someone else” also needs to be vetted to ensure that their first update won’t include crypto mining malware. We should remember that an unmaintained dependency isn’t the worst thing that can happen to a supply chain. There are far worse nightmare scenarios that involve exfiltrated keys, ransomewared files and such. I’ll bet that if someone with a track record of contributing to the Rust community steps up, he’ll happily transfer control of the crate. But he’s not just going to assign it to some random internet user and put the whole ecosystem at risk.
uh_uh 3y ago
What's so irresponsible about it? He clearly communicated the state of affairs. I think he was generous enough with his time for creating the library in the first place and posting this update. It's not like he's owing anything to anybody. I don't understand how you can demand him to do further UNPAID work to recruit maintainers who would also do further unpaid work.
foverzar 3y ago
> he should turn over the repo to someone else to manage Why can't this "someone else" just fork the repo themselves?
keybored 3y ago
Anyone else is free to take it! You see that the repository is hosted under his own user. Anyone else can create an organization or host it under their own name. Are we collectively having Subversion phantom pains or something? Just take it.
shrimp_emoji 3y ago
The obnoxious and irresponsible part is the hubris of thinking you can have a package repository system that's going to not have problems like this and left-pad. You can't. Ever. This is unironically why languages too old for package repositories like C and C++ lend themselves to stabler, higher-quality software. On top of that is also the entitlement to feel like people providing you software for free MUST ALSO be responsible for polishing it forever. But, hey, I guess that attitude comes naturally with the package repository mindset. ;D People need to do all my work for me!
- iknowstuff 3y ago
  > C and C++ > stabler, higher-quality software. Lol I’ll have some too buddy
switch007 3y ago
With the greatest respect, I think it is your attitude that needs adjustment, not their behaviour.
tcmart14 3y ago
I believe he offered for someone to take over and no one ever stepped up to the plate. This happens a lot.

No, it's incredibly irresponsible to hand over the repo to someone else to manage, even someone who is an active contributor. See https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... for example.

steveklabnik 3y ago

I’m not sure how much open source work you’ve done or what packages you’ve maintained, but in my experience, the “someone else” rarely ever comes. Heck I have even been the someone else and then done a bad job of it! This is an unrealistic and frankly a bit entitled of a criticism. This is before we even get to stuff like “it’s not like yaml is a fast moving target, what continued maintenance is really even needed” parts of the equation, or the comment above that said he’s tried already.

curun1r 3y ago
The “someone else” also needs to be vetted to ensure that their first update won’t include crypto mining malware. We should remember that an unmaintained dependency isn’t the worst thing that can happen to a supply chain. There are far worse nightmare scenarios that involve exfiltrated keys, ransomewared files and such. I’ll bet that if someone with a track record of contributing to the Rust community steps up, he’ll happily transfer control of the crate. But he’s not just going to assign it to some random internet user and put the whole ecosystem at risk.

uh_uh 3y ago

What's so irresponsible about it? He clearly communicated the state of affairs. I think he was generous enough with his time for creating the library in the first place and posting this update. It's not like he's owing anything to anybody. I don't understand how you can demand him to do further UNPAID work to recruit maintainers who would also do further unpaid work.

foverzar 3y ago

> he should turn over the repo to someone else to manage Why can't this "someone else" just fork the repo themselves?

keybored 3y ago

Anyone else is free to take it! You see that the repository is hosted under his own user. Anyone else can create an organization or host it under their own name. Are we collectively having Subversion phantom pains or something? Just take it.

shrimp_emoji 3y ago

The obnoxious and irresponsible part is the hubris of thinking you can have a package repository system that's going to not have problems like this and left-pad. You can't. Ever. This is unironically why languages too old for package repositories like C and C++ lend themselves to stabler, higher-quality software. On top of that is also the entitlement to feel like people providing you software for free MUST ALSO be responsible for polishing it forever. But, hey, I guess that attitude comes naturally with the package repository mindset. ;D People need to do all my work for me!

iknowstuff 3y ago
> C and C++ > stabler, higher-quality software. Lol I’ll have some too buddy

switch007 3y ago

With the greatest respect, I think it is your attitude that needs adjustment, not their behaviour.

tcmart14 3y ago

I believe he offered for someone to take over and no one ever stepped up to the plate. This happens a lot.