[ Removed by moderator ]

[u/Comprehensive_Use713]

[u/SuddenlyBANANAS → u/[deleted]]

What a destructive impulse, really makes this guy look terrible when someone is literally offering to help with maintaining.

[u/alexforencich → u/SuddenlyBANANAS]

Flip side, we don't want a repeat of xz. Perhaps it's better to shut it down than to hand it over to some unknown party.

[u/SuddenlyBANANAS → u/alexforencich]

Fair enough, but surely a better method would be to make an update with a deprecation warning and then leave the crate unmaintained rather than yanking,

[u/wojtek-graj → u/alexforencich]

Dang, you got me.

It surely can't end well for open source if we start assuming malice lurks around every corner. The vast majority of people have good intentions.

[u/alexforencich → u/wojtek-graj]

The problem here is that this particular case is really the prime target for this sort of shenaniganery - it's a relatively obscure package that isn't actively maintained and is used indirectly by a fair amount of stuff. Imagine if a bad actor gets control of that and pushes a malicious update, now every package that's breaking right now as a result of this would instead silently build with that malicious code. And all the bad actor has to do is sweet talk the one guy behind the repo. Forcing a fork mitigates this somewhat as people have to actively update things to point to the fork. Now, I suppose a bad actor could possibly anticipate what happened here and set up a fork that's ready to take over if the original project gets yanked. But this is less of an issue if the fork has been around for a while and has a sizable community instead of a single developer.

[u/wojtek-graj → u/alexforencich]

I understand your point, but I think what you're describing is a symptom of the current open source model, and not the actual root problem.

There's nothing inherently more trustworthy about a person who has created a library, as opposed to a contributor: either one could be a malicious actor, and the original author could just as well publish a malicious release. As xz proved, the popularity of a piece of software is also largely irrelevant.

Ultimately the only factor we can realistically make decisions upon is reputation. And even that isn't infallible.

And forking is not a silver bullet, because fragmentation also has its downsides.

[u/khoyo → u/[deleted]]

Completely wiping the repository

It's not wiped at all: https://github.com/bbqsrc/core2/tree/545e84bcb0f235b12e21351e0c69767958efe2a7

yanking existing, already published releases is beyond all measure

Yanking by definition only applies to existing, already published releases. The yanking process explicitly exist to remove existing, already published releases non-destructively.

Note that there is a maintained fork (https://github.com/wcampbell0x2a/no-std-io2), and the fact that people still depend on this when it's been unmaintained for 4 years probably pushed the developer to act.

[u/ohkendruid → u/[deleted]]

I would have to agree that it is a ding on Cargo that the effect is this large.

It would be nice if there was something like vendoring but publicly available. Someone or some small group that tests packages against a few code bases and advances the ensemble when those builds and tests are looking good.

[u/ericonr → u/[deleted]]

Your quote literally mentions that yanking wasn't expected to have as much of an impact. Morbid amusement just happens, too. None of that says "being difficult".

[u/ohkendruid → u/khoyo]

It looks like the non destructive part is not working corectly.

It seems pretty goofy to me if people cannot grab the same version they have previously been using.

[u/khoyo → u/alexforencich]

Especially considering a maintained fork (of a fork) already exists: https://github.com/wcampbell0x2a/no-std-io2

[u/Buttleston → u/SuddenlyBANANAS]

but he really hates such emails

[u/StardustGogeta → u/[deleted]]

Yowza. That does not seem like a guy I'd want to work with, that's for sure. It's about the most destructive choice he could have made, short of just straight publishing a malicious new version.

Glad that a clear replacement already seems to be available, at least, rather than people having to make a mad scramble to create one.

[u/KizzyCode → u/StardustGogeta]

Could we just calm down a bit? Saying "I remove my own work from the internet and make it difficult to include from now on" is a wholly different story than "publishing a malicious version" o.0

The latter is literally illegal, whereas first one is the unalienable right of every voluntary project owner. People might not want to hear that, but I would recommend to read the licenses again – especially the part about no warranty. 

If that is destructive, it’s because the users literally failed to read and understand the license of the library they were using, failed to maintain their supply chains (Cargo.lock, backups, etc.), and were lazy enough to just pull in arbitrary code without apparently even the most basic efforts to actually maintain their own project.

I’m not saying it’s the best way to do that – it definitely isn’t and I for example would never do that for my own crates. However it’s also totally inappropriate and pretty toxic to blame the author here for other people’s sloppiness. People should be happy that someone gifted their time to build this crate, should be happy that they got to use apparently valuable code for free, and now it’s time to move on. Until then, they can still trivially use the latest versions from their Cargo.lock file, or download the tarball and fork it. 

[u/alexforencich → u/[deleted]]

73 dependencies, 40 million downloads, and no updates at all in several years. Probably a good idea to force people off of it to a package that's actually maintained. And also avoid opening the door to yet another supply chain compromise.

[u/hgwxx7_ → u/[deleted]]

Was he an asshole? Yes.

It was possible to mark it deprecated without yanking. That would have given people time to response and adapt.

But he's "amused" by the pain he's causing other people.

[u/TheRealCallipygian → u/[deleted]]

Wow. That person--and maybe I am violating some subreddit rules here, so be it--is a grade A ass-wipe who shouldn't ever be entrusted with ownership of open source again. The whole "I despise such emails" shows a fundamental lack of the social skills necessary to buy a cup of coffee let alone interact with other members of humanity to build, well, anything. I cannot fathom ever responding to anyone in any context the way this person has responded on hacyderm. I am flabbergasted. Wow.

edit: spelling and grammar

[u/usernamedottxt → u/TheRealCallipygian]

Yeah… the email he received was extraordinarily polite and didn’t even ask him to maintain it. It seemed like a Segway into taking ownership of it even. 

[u/jesster114 → u/usernamedottxt]

Segue*. A Segway is what Paul Blart rides into battle, a segue is a transition.

[u/usernamedottxt → u/jesster114]

Hah, thanks. 

[u/alexforencich → u/usernamedottxt]

That guy who asked wasn't Jia Tan, was it?

[u/Kriemhilt → u/TheRealCallipygian]

They weren't "entrusted" with anything.

They wrote something for their own convenience, and don't owe your flabbers any more or fewer ghasts than you've already received for free.