15 ms·

Bob Nystrom (munificent) addressed in elsewhere in this thread, and I’ll repeat his point here: vendoring does make a meaningful difference, because he’s taking

Bob Nystrom (munificent) addressed in elsewhere in this thread, and I’ll repeat his point here: vendoring does make a meaningful difference, because he’s taking responsibility for the code. Separately, I do hope VEX becomes more real / takes off to help address issues of non-applicability for vulnerabilities. That said, I don’t think this is a non-applicability scenario.

keybored 3y ago
Other than an American with a Scandinavian name calling it responsible, what technical difference does it make compared to letting it sit around as a locked dependency? Maybe it makes a technical difference in Rust, I’m not sure. I’m not sold on the argument in the other comment. It’s just a may. Something is not worth more just because there is a potential for something.
- sunshowers 3y ago
  One difference is that a lockfile doesn't apply transitively, while vendoring does.
remram 3y ago
> he’s taking responsibility for the code Is he fixing the bugs reported against the defunct upstream? If not, what is the improvement? And if yes, how can will the rest of the library users benefit from those fixes?
tempaccount420 3y ago
> he's taking responsibility for the code Here's a quote from the project's license: > 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
- sunshowers 3y ago
  There's a difference between laws and norms -- legally, yes, there's no responsibility but as a social norm there is. (This is how all open source works.)

keybored 3y ago

Other than an American with a Scandinavian name calling it responsible, what technical difference does it make compared to letting it sit around as a locked dependency? Maybe it makes a technical difference in Rust, I’m not sure. I’m not sold on the argument in the other comment. It’s just a may. Something is not worth more just because there is a potential for something.

sunshowers 3y ago
One difference is that a lockfile doesn't apply transitively, while vendoring does.

remram 3y ago

> he’s taking responsibility for the code Is he fixing the bugs reported against the defunct upstream? If not, what is the improvement? And if yes, how can will the rest of the library users benefit from those fixes?

tempaccount420 3y ago

> he's taking responsibility for the code Here's a quote from the project's license: > 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.

sunshowers 3y ago
There's a difference between laws and norms -- legally, yes, there's no responsibility but as a social norm there is. (This is how all open source works.)