9 ms·

I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that

by vunie 7y ago

I don't know how to word this so I'll say it bluntly (and probably bear the blunt of this community as a consequence): If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project. No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Of course, you could do neither, but don't be surprised when people call you out on it.

ginko 7y ago
I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- disintegore 7y ago
  IANAL but I'm fairly certain this protects you against legal action and not negativity on the internet. Furthermore, if we're to interpret this clause as "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.
  - jasonlotito 7y ago
    From the grand parent: "If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project." The reply: "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ... FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT." Furthermore, from the GP: "No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them." Nothing in the license implies any such guarantee. > "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large. I mean, that's what the license says. If you want assurances, get it in writing. Otherwise, when you use code, it's on you to make that guarantee of the code you are using. Entitlement. Gimme gimme gimme. It's a shame.
    - disintegore 7y ago
      I didn't think it could be so difficult to separate legal contracts from social ones. If you have voluntarily assumed the role of maintaining an open source project, it's perfectly reasonable for people to expect you to address merge requests and issues on the issue tracker. It's reasonable to expect a maintainer to process technical arguments and justify their technical decisions. The maintainer of course has no legal or moral obligation to perform any of these tasks. If he should ignore these assumed responsibilities, the users of the software can react in multiple ways. They can fork the project or use something else. In both cases they are also completely and utterly within their right to put into question the reliability and credibility of the aforementioned maintainer. Especially where it concerns software that people rely on for critical processes. All the "as is" clause means for security concerns (apart from its legal implications) is that the burden of making these guarantees lies on the community, and not the emitter of the software. It does not mean you should have no expectations of it at all and to suggest so is, frankly, nonsense. Lastly, I think if anyone is "entitled" to anything, it's respect. If the developer of actix truly felt like he was not getting the respect he deserved then his reaction is completely justified.
      - sneak 7y ago
        Legal statements aren't special. They are also plain old social statements, which I think was his point. It's not solely a "don't sue me".
        ssokolow 7y ago
        However, that disclaimer exists in all major open-source licenses, including all such software explicitly marketed such that a Reasonable Person (in the legal sense) would interpret it as a statement of fitness for purpose. Thus, the disclaimer in the license cannot double as a disclaimer in the social arena.
- ekianjo 7y ago
  > I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply This is a really bad answer because the most reliable and robust free software projects out there all use this same boilerplate license warnings. This is just for legal protection.
  - kube-system 7y ago
    I think it is a fine answer, albeit incomplete. Many of those robust projects you mention are supported by contracts which do guarantee some work is being done. If you’d like some guarantees of quality, you are free to negotiate a contract with the maintainers for those guarantees. Think of MIT’s warranty disclaimer as the “free tier” of service.
  - watwut 7y ago
    No, that is actual scope of warranty and assurance those developers intend to promiss. Everything else is beyond and above. I pretty much guarantee you that if the "clearly mark your project as toy project" thing would become something people actually are expected to use, it would be everywhere too. As if now it is nowhere, not on very clear toy projects and not on serious looking projects thay are sparsely maintained. The ones with license are all clear on limited warranty.
- jimbokun 7y ago
  Sure, so in the case of actix-web, the decision of many has been to stop using the project because it wasn't safe. I didn't see any discussion of legal liability, just a community deciding to stop using and supporting this library. (Just going by Klabnik's article, I knew nothing about this library before reading it. There may be more context of which I'm not aware.)
  - steveklabnik 7y ago
    I am not aware of anyone bringing legal liability into this situation, in any form.
    - jimbokun 7y ago
      I am replying to a comment citing legal liability language from a license?
      - steveklabnik 7y ago
        I was trying to address your "There may be more context of which I'm not aware," and all I was trying to say is that nobody was making claims that somehow the author was violating some sort of license duty or whatever.
- pjc50 7y ago
  We're not expecting a warranty and we're not asking for damages. It's not really surprising that the Rust community is made out of people who've chosen to take extra effort in security, and that they wouldn't tolerate a cavalier attitude to it. It's disappointing that this was expressed in an unconstructive way.
- 4bpp 7y ago
  A similar disclaimer is contained in the GPLv2 and therefore applies to the Linux kernel. Does that mean we can not impose any expectations regarding security on its maintainers either? Why can't we have legal disclaimers like this so that the legal system with its tech-oblivious case law and multi-million-dollar penalties is prevented from interfering while also retaining softer sanctions such as the threat of community ostracism/obnoxious messages to incentivise some degree of quality?
  - AlexandrB 7y ago
    > Does that mean we can not impose any expectations regarding security on its maintainers either? Yes. If you want a secure version of Linux, pay a vendor like Red Hat who’s willing to provide those assurances.
- tolmasky 7y ago
  OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". There is a difference between "Hey, this is a silly side project so definitely use at your own risk, as far as I'm concerned its a place for me to learn and should be treated as a toy" and "Hey, I think this is worth your time, you should use this in your production stack, and obviously I've set up legal protections so you can't sue me if something goes wrong, but I am trying to push this as something lots of people should use and trust". If someone walks into my house and tries cookies I'm clearly learning how to make and then throws up, that's very different than me putting up a big "FREE AMAZING BETTER COOKIES" sign on the sidewalk and handing them out and having people throw up. In both scenarios, the cookies are free! What are you blaming me for! How entitled! In the first, I think that position is more defendable. In the second, ehhh..... For the record -- I'm not super familiar with this project, but I think that a lot of people don't consider the ramifications of being successful sometimes: your project could be used by a big company and lead to people's information getting hacked (and those people had nothing to do with any of these decisions). The only thing asked is to be upfront that this is not intended for that, as opposed to the temptation of calling your thing the best and telling everyone to use it. In the run up of a project, I think it's easy to forget that and get really hyped on showing how your thing is better than some incumbent for example. Just something to keep in mind.
  - kelnos 7y ago
    > OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". Essentially: yes. If you want any guarantees beyond that, you have to pay for them, or trust that others have paid for them. Absent that, you have to make your own judgment as to whether or not the maintainers will run the project in a way you feel comfortable with. If they do; great. If not, move on (or contribute, or fork it), because you have no right to tell them how to maintain their project.
blackearl 7y ago
I'm sure both sides are being childish here. Users thinking they can abuse a dev because they know better, and devs deciding they'd rather take their ball and go home. No one looks good at the end of this situation.
- m000z0rz 7y ago
  How is taking your ball and going home childish when an angry mob is after you? Seems like a rational response to me.
- pertymcpert 7y ago
  Your analogy is stupid. People are still able to fork the project. Taking the ball and going home means that you prevent everyone else from playing,
- watwut 7y ago
  Taking the ball home when other kids abuse or bully you is correct action. That is actually one of the things we teach the kids who are in these situations to do. It is ok to have a boundary, it is ok to leave the situation and it is ok to stand your ground. You don't ask for abuser validation nor permission.
manish_gill 7y ago
> No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. It's not like he was getting paid to work on this, was it? And people do have a life beyond open source. People could have forked and worked on the issues themselves, but that's asking too much. Why do the hard work when you can just write a comment/tweet blaming someone else, right? Your comment is precisely what entitlement looks like.
- deleted 7y ago
  [deleted]
- adar 7y ago
  From what sklabnik's post says, patches were submitted but the author wasn't really receptive to them.
  - jwlake 7y ago
    I honestly dont understand people being mad at this. Every dependancy I use I don't like 100% I fork and modify and then upstream changes, and if they never get merged, who cares? If there was a big user community that wanted different things, fork and have a seperate maintainer structure. Why drama?
    - boutad 7y ago
      Then you might end up with a bunch of different forks each with different fixes applied.
      - pfortuny 7y ago
        And?
        boutad 7y ago
        Wouldn't it be better if there was one repo that had all of the fixes?
mumphster 7y ago
More like you should be expected, as a user, to look at the code youre using and determine if it fits your set of criteria. If you dont think its updated enough, or the authors free labor isnt fast enough for your needs, then dont use it. You come off super entitled and arent the only one. This is the kinda stuff thats making me start my new projects closed source instead of open by default.
coleifer 7y ago
How about instead of pushing the responsibility on someone else, you take responsibility for YOUR security-sensitive context and do the research before you start installing libraries?
- ixtli 7y ago
  exactly. the dev has to take responsibility for what they write but there’s no responsibility required when you run something??
- jimbokun 7y ago
  Isn't that exactly what happened? This article is someone who did that research on multiple Rust HTTP clients and reported what they found: https://medium.com/@shnatsel/smoke-testing-rust-http-clients-b8f2ee5db4e6 https://medium.com/@shnatsel/smoke-testing-rust-http-clients... Which I believe is what kicked off the events leading to Klabnik's blog post?
  - UncleMeat 7y ago
    That’s fine. “Hey, this project has bugs maybe don’t use it” is fine. Dog piles on Internet forums because the dev isn’t doing what you want isn’t fine.
    - throwaway765432 7y ago
      > Dog piles on Internet forums because the dev isn’t doing what you want isn’t fine. Therein lies the problem. You cannot reasonably expect to link a blog post that says what that one did on Reddit and not have people dog pile. They will, every single time.
ixtli 7y ago
what code does not run in a “security-sensitive context”? who’s responsibility is it really? The person who wrote the code with a disclaimer saying they were presenting it to you AS-IS? Or the person who’s choosing to run the code in the “security-sensitive context?”
oefrha 7y ago
According to https://github.com/actix/actix-web https://github.com/actix/actix-web, it appears that the author did accept the security concerns (when an actual use-after-free was found, but maybe not the previous, generic “unsafe oh noz” shitstorms), and wanted to explore some other way to fix the problem instead of accepting the patch as is. Just because there’s a patch that fixes the issue doesn’t mean the maintainer has to merge that patch.
- mratsim 7y ago
  The maintainer still shouldn't dismiss a patch + test case with "it's boring".
  - wvenable 7y ago
    Why not? The only reason I work on personal open source projects is because it's interesting to me. Otherwise, why would I bother?
    - mratsim 7y ago
      He can reject the patch. But the tone is important as well. And that was that "it's boring" reply that triggered an angry response from a passerby about "you shouldn't write libraries" (or something in vein).
  - Izkata 7y ago
    He didn't. From what I can tell from reconstructed logs posted elsewhere here, he rejected a proof-of-concept the poster suggested someone else continue with.
Ragnarork 7y ago
What must have gone horribly wrong during the course of software history that led to people acting so entitled about free open source projects? You use it, you evaluate then accept the consequences. You don't? Well Patch it. You can't? Use an alternative. Nothing else available? Fork it and fix it. If nothing works for you, then either you're the problem, or the entire field has an unsolved problem (and you're not helping, especially when slamming people working for free trying to solve it, even if not correctly or the way you'd like).
- cloverich 7y ago
  The thing that changed is we began building off of more and more open source, and so it became more and more important. Nobody is expecting a project's original creator to slave over it eternally. They are instead expecting them to clearly signal their intentions. A "Not Maintained" flag, or "Read my design philosophy before using", after understanding community expectations, is no effort and a reasonable expectation. Counter arguments like to think we are islands and that because we never signed an official contract, we have no responsibilities to anyone but ourselves. But that is not how society ever has or ever will work, and there never has nor ever will be any such thing as "leaving" society (other than death). There's a social contract that you are (unwillingly) a part of, and that's reality. Entitlement here is merely people implicitly recognizing that fact. EDIT: This rant is a general reply to your general sentiment, not a specific reply to this particular case. I have no idea whether the author did in fact signal appropriately their design, risk, etc.
- charonn0 7y ago
  It all went wrong when the number of users exceeded the number of programmers.
- sneak 7y ago
  This is an oversimplified view. One could say the same thing about eg free services from Google or Facebook. It doesn't prevent us from saying "operating in this way is bad/destructive", even if one chooses not to use the code or service.
bla3 7y ago
If you're a developer of an open-source project and people start using that, it's on the users to verify that the project is security-conscious. I open-source lots of my fun hacks for free in the hope that they're useful for someone, but I'm not going to do free unfun work just because someone decided to use my hack in production. Users of open-source software are acting way too entitled.
protomyth 7y ago
No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Looking at the postmortem[1], it looks like the patches provided were not good enough in the developer's eyes: I believed it held mutable aliasing invariant and I was very happy that someone found real problem. I wanted to solve the problem, just with a bit of creativity. And use RefCell solution only if it would be not possible to solve it with any other way. Btw, I like the solution I found, it is in master and solves the problem at least one from the issue. If you want to push boundaries you have to touch this boundaries and sometimes you push too hard. That sounds very much like the developer was headed to fixing them, but I guess the harassment and need for now won.
- cerebellum42 7y ago
  Maybe that is what the developer intended, but afaik it is not what he communicated. What he communicated was a flat out dismissal of the issue along with the proposed fixes. Followed by deleting the whole issue from GitHub. To be fair, there were some very unpleasant things said in there, but he could have just deleted those and maybe locked the conversation telling people about his plans. This whole thing was a feedback circle of increasing hostility between the community/contributors and this developer. At some points the developer was very unresponsive, leading to disappointment from the community, but then some very uncalled for personal attacks came from the community. I think the developer received some justified criticism, but I still understand his perspective, putting work in and getting abuse back sucks.
  - protomyth 7y ago
    So, how fast do people expect developers of open source projects to respond before someone is considered unresponsive? I'm not sure combining social media with code control is going to be such a good thing for a lot of developers who might not like to program in a fishbowl.
    - zozbot234 7y ago
      Expecting a reasonably-quick response to security concerns is certainly appropriate.
clarry 7y ago
Who is we? People who write security sensitive toys and don't care enough to vet their deps? Professionals who profit off security sensitive programs written on top of others' free work without paying a dime? I don't think either group is in a position to make such demands.
013a 7y ago
> If you're a developer of a project that is used in a security-sensitive context Working in the context of Security does not grant you a blank check to be an asshole.
velcrovan 7y ago
Backing up another level...it’s concerning to me when a language relies heavily on single-maintainer libraries for commonly needed functionality. If actix-web was this important, it should have been adopted by the community before now. Maybe languages need a way of setting the expectation to that if your library becomes essential to the community (and if licensing allows) the core developers are going to fork it and find a way to govern/maintain it the same way they maintain the rest of the project. I think about this a lot with Racket lately. Some of the core packages that everyone uses for date/time, Markdown parsing, etc., were written by a single guy in his spare time, who a few months ago was making noises about quitting the language (so far so good though).
- TrueDuality 7y ago
  The developer actively fought against this for a very long time, even before the reddit shit storms. Yes the community could have forked the project and started independent development. I'd argue that forking and developing independently of the developer is as big of a middle finger as a developer taking their ball and going home. It just depends on who is on the receiving end. I don't think either side is right here, but I don't think creating a public fork and building a community around that is an unbiased and neutral response either and should only be done in extreme circumstances... Which is does seem like what happened here.
  - zozbot234 7y ago
    > I don't think either side is right here, but I don't think creating a public fork and building a community around that is an unbiased and neutral response Linux distro maintainers routinely create "public forks" even of actively-maintained packages, and no one sane views that as a hostile move or something to complain about. It's part of curating a well-kept ecosystem around your solutions.
    - notriddle 7y ago
      > Linux distro maintainers routinely create "public forks" even of actively-maintained packages, and no one sane views that as a hostile move or something to complain about. https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop-shipping-xscreensaver/ https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop...
megaman821 7y ago
Is there anything else you would like to demand about people's code they you are not paying them to write? I demand you go write a tool that lets me query projects and tells me if you think they are a toy or not. I'll wait.
lostmyoldone 7y ago
I'll be blunt too. If you use other peoples work for free and makes demands, then you should really stop using others free work and start paying for what you need. It's your responsibility to choose what code you use, and unless the author has explicitly given specific guarantees they promise to uphold come hell or high water, it IS a toy project until proven otherwise. It's such absolute nonsense to expect other people to submit to your wishes and whims without any compensation or prior consent. But chastising someone in public for not submitting to your wishes? That's straight up bullying.
andonisus 7y ago
If you aren't satisfied with the code, fork it and fix it yourself. You are owed nothing. What right do people think they have to call someone out on it? Why do they feel entitled to other people's time and energy?
fsloth 7y ago
"we do expect you to fix flaws when you learn about them." If hope the plural we is also ready to monetarily compensate the developer for their time. Otherwise you don't have any basis for your expectation.
cmiles74 7y ago
The popularity of a project doesn't change it from "toy" or "personal" to "primary focus of developer's time". The developer might still only have so much time to spend on the project.
Karunamon 7y ago
People reading your comment as entitlement really need to pay more attention to the last paragraph. People really need to stop bandying about "entitlement" as if it deflects any and all criticism. You are, of course, free to write whatever unsafe, insecure code you want. You are, by leaving the issue tracker in Github enabled, inviting public feedback on the quality of the code you write. When you implicitly rescind that invitation by closing issues demonstrating concrete safety problems, people are well within their rights to call out the safety issues in the project as well as your violation of reasonable expectations and community norms. And don't bother posting the "warranty disclaimer" from FOSS licenses, that's not what anyone was ever talking about. Deleting the entire project as he did is an incredibly petty and immature response. If he just wanted to quit, the project could have been archived (made read-only) and marked unmaintained.
- catalogia 7y ago
  I generally agree, except for this part: "Deleting the entire project as he did is an incredibly petty and immature response." If he no longer wants to participate in the community, then deleting the repo was a good decision. It's not like the code is actually gone, other people have copies of it, and now that the original repo is gone nobody will mistakenly go to his repo and find it abandoned. It's basically the equivalent of boarding up the windows before you abandon a building.
  - Karunamon 7y ago
    Archiving the repo (which disables new commits, new issues, etc) would have served the same goal and not wasted the time of the larger community. Here's an example from one of my own archived projects. Is there any doubt in your mind as to the state of this repository? https://github.com/karunamon/concourse-resource-bitbucket https://github.com/karunamon/concourse-resource-bitbucket Inconveniencing countless others in a fit of pique is a pretty good definition of immature, petty behavior.
deleted 7y ago
[deleted]
bornelsewhere 7y ago
This. The project is considered one of the (if not the) go-to web frameworks in Rust, lives under its own organisation, is promoted and discussed by many other people. It's not a sole property of the maintainer any more. The maintainer does not owe anyone any new code, nor accepting any PRs. But he does have to set correct expectations. If you want to be the sole BDFL and not care about others opinions or contributions then don't promote it as production code, keep it under your own profile, and/or make it clear in the README. Now it's a community project, "fun" is not necessarily the most important quality anymore. State your position early.
deleted 7y ago
[deleted]
Skunkleton 7y ago
> bear the blunt It's "bear the brunt".
carapace 7y ago
("bear the brunt" It's one of those weird words that only exists now in that phrase. Brunts are borne but otherwise unmentioned. It's kinda like how you can be over- or underwhelmed, but never just whelmed.)
jimmydorry 7y ago
Why should a project author dictate in what contexts their project can be used? It's on the coder to manage their dependencies and ensure they are a good fit for their needs... not the project author. And what exactly are you contributing to this project author to match your demands of them immediately fixing flaws that are found?
egdod 7y ago
>people who already volunteer their time for my benefit have to follow my rules when doing so Ok.
awb 7y ago
> you either be receptive to security concerns or you clearly label your project as a toy project. Or, assume all OSS projects are toy projects unless stated otherwise. Usually the serious ones offer a support license for a fee, or are supported financially by companies. Otherwise, it's just someone building cool stuff for free. Also, it's probably fair that most OSS maintainers aren't marketing their projects too aggressively outside of a blog post or a Reddit submission. When they take off, it's usually other developers hyping them and that hype usually comes from being lightweight, easy to configure or super fast. It's not until a project has been hyped by the community do people start trying to put it into production and looking into security issues.
- ssokolow 7y ago
  I think that https://actix.rs/ https://actix.rs/ counts as an implicit "the author doesn't intend this to be seen as a toy project" in people's eyes.
  - mwcampbell 7y ago
    One thing that nobody here seems to have mentioned is that, as far as I can tell, the actix.rs website was not created by the author of Actix itself. Just compare the writing on the website with the author's own postmortem. I don't know who wrote the website; I can't find an author's name or a Git repo for the site itself. But whoever they were, it seems that they, not the author of Actix itself, did the marketing that gave many of us our primary impression of what kind of project this is. If anyone reading this knows more about the history of the website, I'd appreciate any additional background or pointers to more details. Edit: After running some git blame commands on the https://github.com/actix/actix-website https://github.com/actix/actix-website repository (thanks Nikolay for keeping it there), it seems that the most eloquent marketing for the project was written by Armin Ronacher. I'm sure this was all done with Nikolay's permission, since it's under the actix GitHub organization, but my point is that Nikolay himself didn't say the things that have been quoted from the website, and they didn't necessarily reflect his own attitude about the project. So that might have caused some confusion.

by vunie 7y ago

ginko 7y ago

I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

disintegore 7y ago
IANAL but I'm fairly certain this protects you against legal action and not negativity on the internet. Furthermore, if we're to interpret this clause as "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.
- jasonlotito 7y ago
  From the grand parent: "If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project." The reply: "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ... FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT." Furthermore, from the GP: "No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them." Nothing in the license implies any such guarantee. > "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large. I mean, that's what the license says. If you want assurances, get it in writing. Otherwise, when you use code, it's on you to make that guarantee of the code you are using. Entitlement. Gimme gimme gimme. It's a shame.
  - disintegore 7y ago
    I didn't think it could be so difficult to separate legal contracts from social ones. If you have voluntarily assumed the role of maintaining an open source project, it's perfectly reasonable for people to expect you to address merge requests and issues on the issue tracker. It's reasonable to expect a maintainer to process technical arguments and justify their technical decisions. The maintainer of course has no legal or moral obligation to perform any of these tasks. If he should ignore these assumed responsibilities, the users of the software can react in multiple ways. They can fork the project or use something else. In both cases they are also completely and utterly within their right to put into question the reliability and credibility of the aforementioned maintainer. Especially where it concerns software that people rely on for critical processes. All the "as is" clause means for security concerns (apart from its legal implications) is that the burden of making these guarantees lies on the community, and not the emitter of the software. It does not mean you should have no expectations of it at all and to suggest so is, frankly, nonsense. Lastly, I think if anyone is "entitled" to anything, it's respect. If the developer of actix truly felt like he was not getting the respect he deserved then his reaction is completely justified.
    - sneak 7y ago
      Legal statements aren't special. They are also plain old social statements, which I think was his point. It's not solely a "don't sue me".
      - ssokolow 7y ago
        However, that disclaimer exists in all major open-source licenses, including all such software explicitly marketed such that a Reasonable Person (in the legal sense) would interpret it as a statement of fitness for purpose. Thus, the disclaimer in the license cannot double as a disclaimer in the social arena.
ekianjo 7y ago
> I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply This is a really bad answer because the most reliable and robust free software projects out there all use this same boilerplate license warnings. This is just for legal protection.
- kube-system 7y ago
  I think it is a fine answer, albeit incomplete. Many of those robust projects you mention are supported by contracts which do guarantee some work is being done. If you’d like some guarantees of quality, you are free to negotiate a contract with the maintainers for those guarantees. Think of MIT’s warranty disclaimer as the “free tier” of service.
- watwut 7y ago
  No, that is actual scope of warranty and assurance those developers intend to promiss. Everything else is beyond and above. I pretty much guarantee you that if the "clearly mark your project as toy project" thing would become something people actually are expected to use, it would be everywhere too. As if now it is nowhere, not on very clear toy projects and not on serious looking projects thay are sparsely maintained. The ones with license are all clear on limited warranty.
jimbokun 7y ago
Sure, so in the case of actix-web, the decision of many has been to stop using the project because it wasn't safe. I didn't see any discussion of legal liability, just a community deciding to stop using and supporting this library. (Just going by Klabnik's article, I knew nothing about this library before reading it. There may be more context of which I'm not aware.)
- steveklabnik 7y ago
  I am not aware of anyone bringing legal liability into this situation, in any form.
  - jimbokun 7y ago
    I am replying to a comment citing legal liability language from a license?
    - steveklabnik 7y ago
      I was trying to address your "There may be more context of which I'm not aware," and all I was trying to say is that nobody was making claims that somehow the author was violating some sort of license duty or whatever.
pjc50 7y ago
We're not expecting a warranty and we're not asking for damages. It's not really surprising that the Rust community is made out of people who've chosen to take extra effort in security, and that they wouldn't tolerate a cavalier attitude to it. It's disappointing that this was expressed in an unconstructive way.
4bpp 7y ago
A similar disclaimer is contained in the GPLv2 and therefore applies to the Linux kernel. Does that mean we can not impose any expectations regarding security on its maintainers either? Why can't we have legal disclaimers like this so that the legal system with its tech-oblivious case law and multi-million-dollar penalties is prevented from interfering while also retaining softer sanctions such as the threat of community ostracism/obnoxious messages to incentivise some degree of quality?
- AlexandrB 7y ago
  > Does that mean we can not impose any expectations regarding security on its maintainers either? Yes. If you want a secure version of Linux, pay a vendor like Red Hat who’s willing to provide those assurances.
tolmasky 7y ago
OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". There is a difference between "Hey, this is a silly side project so definitely use at your own risk, as far as I'm concerned its a place for me to learn and should be treated as a toy" and "Hey, I think this is worth your time, you should use this in your production stack, and obviously I've set up legal protections so you can't sue me if something goes wrong, but I am trying to push this as something lots of people should use and trust". If someone walks into my house and tries cookies I'm clearly learning how to make and then throws up, that's very different than me putting up a big "FREE AMAZING BETTER COOKIES" sign on the sidewalk and handing them out and having people throw up. In both scenarios, the cookies are free! What are you blaming me for! How entitled! In the first, I think that position is more defendable. In the second, ehhh..... For the record -- I'm not super familiar with this project, but I think that a lot of people don't consider the ramifications of being successful sometimes: your project could be used by a big company and lead to people's information getting hacked (and those people had nothing to do with any of these decisions). The only thing asked is to be upfront that this is not intended for that, as opposed to the temptation of calling your thing the best and telling everyone to use it. In the run up of a project, I think it's easy to forget that and get really hyped on showing how your thing is better than some incumbent for example. Just something to keep in mind.
- kelnos 7y ago
  > OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". Essentially: yes. If you want any guarantees beyond that, you have to pay for them, or trust that others have paid for them. Absent that, you have to make your own judgment as to whether or not the maintainers will run the project in a way you feel comfortable with. If they do; great. If not, move on (or contribute, or fork it), because you have no right to tell them how to maintain their project.

blackearl 7y ago

I'm sure both sides are being childish here. Users thinking they can abuse a dev because they know better, and devs deciding they'd rather take their ball and go home. No one looks good at the end of this situation.

m000z0rz 7y ago
How is taking your ball and going home childish when an angry mob is after you? Seems like a rational response to me.
pertymcpert 7y ago
Your analogy is stupid. People are still able to fork the project. Taking the ball and going home means that you prevent everyone else from playing,
watwut 7y ago
Taking the ball home when other kids abuse or bully you is correct action. That is actually one of the things we teach the kids who are in these situations to do. It is ok to have a boundary, it is ok to leave the situation and it is ok to stand your ground. You don't ask for abuser validation nor permission.

manish_gill 7y ago

> No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. It's not like he was getting paid to work on this, was it? And people do have a life beyond open source. People could have forked and worked on the issues themselves, but that's asking too much. Why do the hard work when you can just write a comment/tweet blaming someone else, right? Your comment is precisely what entitlement looks like.

deleted 7y ago
[deleted]
adar 7y ago
From what sklabnik's post says, patches were submitted but the author wasn't really receptive to them.
- jwlake 7y ago
  I honestly dont understand people being mad at this. Every dependancy I use I don't like 100% I fork and modify and then upstream changes, and if they never get merged, who cares? If there was a big user community that wanted different things, fork and have a seperate maintainer structure. Why drama?
  - boutad 7y ago
    Then you might end up with a bunch of different forks each with different fixes applied.
    - pfortuny 7y ago
      And?
      - boutad 7y ago
        Wouldn't it be better if there was one repo that had all of the fixes?

mumphster 7y ago

More like you should be expected, as a user, to look at the code youre using and determine if it fits your set of criteria. If you dont think its updated enough, or the authors free labor isnt fast enough for your needs, then dont use it. You come off super entitled and arent the only one. This is the kinda stuff thats making me start my new projects closed source instead of open by default.

coleifer 7y ago

How about instead of pushing the responsibility on someone else, you take responsibility for YOUR security-sensitive context and do the research before you start installing libraries?

ixtli 7y ago
exactly. the dev has to take responsibility for what they write but there’s no responsibility required when you run something??
jimbokun 7y ago
Isn't that exactly what happened? This article is someone who did that research on multiple Rust HTTP clients and reported what they found: https://medium.com/@shnatsel/smoke-testing-rust-http-clients-b8f2ee5db4e6 https://medium.com/@shnatsel/smoke-testing-rust-http-clients... Which I believe is what kicked off the events leading to Klabnik's blog post?
- UncleMeat 7y ago
  That’s fine. “Hey, this project has bugs maybe don’t use it” is fine. Dog piles on Internet forums because the dev isn’t doing what you want isn’t fine.
  - throwaway765432 7y ago
    > Dog piles on Internet forums because the dev isn’t doing what you want isn’t fine. Therein lies the problem. You cannot reasonably expect to link a blog post that says what that one did on Reddit and not have people dog pile. They will, every single time.

ixtli 7y ago

what code does not run in a “security-sensitive context”? who’s responsibility is it really? The person who wrote the code with a disclaimer saying they were presenting it to you AS-IS? Or the person who’s choosing to run the code in the “security-sensitive context?”

oefrha 7y ago

According to https://github.com/actix/actix-web https://github.com/actix/actix-web, it appears that the author did accept the security concerns (when an actual use-after-free was found, but maybe not the previous, generic “unsafe oh noz” shitstorms), and wanted to explore some other way to fix the problem instead of accepting the patch as is. Just because there’s a patch that fixes the issue doesn’t mean the maintainer has to merge that patch.

mratsim 7y ago
The maintainer still shouldn't dismiss a patch + test case with "it's boring".
- wvenable 7y ago
  Why not? The only reason I work on personal open source projects is because it's interesting to me. Otherwise, why would I bother?
  - mratsim 7y ago
    He can reject the patch. But the tone is important as well. And that was that "it's boring" reply that triggered an angry response from a passerby about "you shouldn't write libraries" (or something in vein).
- Izkata 7y ago
  He didn't. From what I can tell from reconstructed logs posted elsewhere here, he rejected a proof-of-concept the poster suggested someone else continue with.

Ragnarork 7y ago

What must have gone horribly wrong during the course of software history that led to people acting so entitled about free open source projects? You use it, you evaluate then accept the consequences. You don't? Well Patch it. You can't? Use an alternative. Nothing else available? Fork it and fix it. If nothing works for you, then either you're the problem, or the entire field has an unsolved problem (and you're not helping, especially when slamming people working for free trying to solve it, even if not correctly or the way you'd like).

cloverich 7y ago
The thing that changed is we began building off of more and more open source, and so it became more and more important. Nobody is expecting a project's original creator to slave over it eternally. They are instead expecting them to clearly signal their intentions. A "Not Maintained" flag, or "Read my design philosophy before using", after understanding community expectations, is no effort and a reasonable expectation. Counter arguments like to think we are islands and that because we never signed an official contract, we have no responsibilities to anyone but ourselves. But that is not how society ever has or ever will work, and there never has nor ever will be any such thing as "leaving" society (other than death). There's a social contract that you are (unwillingly) a part of, and that's reality. Entitlement here is merely people implicitly recognizing that fact. EDIT: This rant is a general reply to your general sentiment, not a specific reply to this particular case. I have no idea whether the author did in fact signal appropriately their design, risk, etc.
charonn0 7y ago
It all went wrong when the number of users exceeded the number of programmers.
sneak 7y ago
This is an oversimplified view. One could say the same thing about eg free services from Google or Facebook. It doesn't prevent us from saying "operating in this way is bad/destructive", even if one chooses not to use the code or service.

bla3 7y ago

If you're a developer of an open-source project and people start using that, it's on the users to verify that the project is security-conscious. I open-source lots of my fun hacks for free in the hope that they're useful for someone, but I'm not going to do free unfun work just because someone decided to use my hack in production. Users of open-source software are acting way too entitled.

protomyth 7y ago

No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them. Looking at the postmortem[1], it looks like the patches provided were not good enough in the developer's eyes: I believed it held mutable aliasing invariant and I was very happy that someone found real problem. I wanted to solve the problem, just with a bit of creativity. And use RefCell solution only if it would be not possible to solve it with any other way. Btw, I like the solution I found, it is in master and solves the problem at least one from the issue. If you want to push boundaries you have to touch this boundaries and sometimes you push too hard. That sounds very much like the developer was headed to fixing them, but I guess the harassment and need for now won.

cerebellum42 7y ago
Maybe that is what the developer intended, but afaik it is not what he communicated. What he communicated was a flat out dismissal of the issue along with the proposed fixes. Followed by deleting the whole issue from GitHub. To be fair, there were some very unpleasant things said in there, but he could have just deleted those and maybe locked the conversation telling people about his plans. This whole thing was a feedback circle of increasing hostility between the community/contributors and this developer. At some points the developer was very unresponsive, leading to disappointment from the community, but then some very uncalled for personal attacks came from the community. I think the developer received some justified criticism, but I still understand his perspective, putting work in and getting abuse back sucks.
- protomyth 7y ago
  So, how fast do people expect developers of open source projects to respond before someone is considered unresponsive? I'm not sure combining social media with code control is going to be such a good thing for a lot of developers who might not like to program in a fishbowl.
  - zozbot234 7y ago
    Expecting a reasonably-quick response to security concerns is certainly appropriate.

clarry 7y ago

Who is we? People who write security sensitive toys and don't care enough to vet their deps? Professionals who profit off security sensitive programs written on top of others' free work without paying a dime? I don't think either group is in a position to make such demands.

013a 7y ago

> If you're a developer of a project that is used in a security-sensitive context Working in the context of Security does not grant you a blank check to be an asshole.

velcrovan 7y ago

Backing up another level...it’s concerning to me when a language relies heavily on single-maintainer libraries for commonly needed functionality. If actix-web was this important, it should have been adopted by the community before now. Maybe languages need a way of setting the expectation to that if your library becomes essential to the community (and if licensing allows) the core developers are going to fork it and find a way to govern/maintain it the same way they maintain the rest of the project. I think about this a lot with Racket lately. Some of the core packages that everyone uses for date/time, Markdown parsing, etc., were written by a single guy in his spare time, who a few months ago was making noises about quitting the language (so far so good though).

TrueDuality 7y ago
The developer actively fought against this for a very long time, even before the reddit shit storms. Yes the community could have forked the project and started independent development. I'd argue that forking and developing independently of the developer is as big of a middle finger as a developer taking their ball and going home. It just depends on who is on the receiving end. I don't think either side is right here, but I don't think creating a public fork and building a community around that is an unbiased and neutral response either and should only be done in extreme circumstances... Which is does seem like what happened here.
- zozbot234 7y ago
  > I don't think either side is right here, but I don't think creating a public fork and building a community around that is an unbiased and neutral response Linux distro maintainers routinely create "public forks" even of actively-maintained packages, and no one sane views that as a hostile move or something to complain about. It's part of curating a well-kept ecosystem around your solutions.
  - notriddle 7y ago
    > Linux distro maintainers routinely create "public forks" even of actively-maintained packages, and no one sane views that as a hostile move or something to complain about. https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop-shipping-xscreensaver/ https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop...

megaman821 7y ago

Is there anything else you would like to demand about people's code they you are not paying them to write? I demand you go write a tool that lets me query projects and tells me if you think they are a toy or not. I'll wait.

lostmyoldone 7y ago

I'll be blunt too. If you use other peoples work for free and makes demands, then you should really stop using others free work and start paying for what you need. It's your responsibility to choose what code you use, and unless the author has explicitly given specific guarantees they promise to uphold come hell or high water, it IS a toy project until proven otherwise. It's such absolute nonsense to expect other people to submit to your wishes and whims without any compensation or prior consent. But chastising someone in public for not submitting to your wishes? That's straight up bullying.

andonisus 7y ago

If you aren't satisfied with the code, fork it and fix it yourself. You are owed nothing. What right do people think they have to call someone out on it? Why do they feel entitled to other people's time and energy?

fsloth 7y ago

"we do expect you to fix flaws when you learn about them." If hope the plural we is also ready to monetarily compensate the developer for their time. Otherwise you don't have any basis for your expectation.

cmiles74 7y ago

The popularity of a project doesn't change it from "toy" or "personal" to "primary focus of developer's time". The developer might still only have so much time to spend on the project.

Karunamon 7y ago

People reading your comment as entitlement really need to pay more attention to the last paragraph. People really need to stop bandying about "entitlement" as if it deflects any and all criticism. You are, of course, free to write whatever unsafe, insecure code you want. You are, by leaving the issue tracker in Github enabled, inviting public feedback on the quality of the code you write. When you implicitly rescind that invitation by closing issues demonstrating concrete safety problems, people are well within their rights to call out the safety issues in the project as well as your violation of reasonable expectations and community norms. And don't bother posting the "warranty disclaimer" from FOSS licenses, that's not what anyone was ever talking about. Deleting the entire project as he did is an incredibly petty and immature response. If he just wanted to quit, the project could have been archived (made read-only) and marked unmaintained.

catalogia 7y ago
I generally agree, except for this part: "Deleting the entire project as he did is an incredibly petty and immature response." If he no longer wants to participate in the community, then deleting the repo was a good decision. It's not like the code is actually gone, other people have copies of it, and now that the original repo is gone nobody will mistakenly go to his repo and find it abandoned. It's basically the equivalent of boarding up the windows before you abandon a building.
- Karunamon 7y ago
  Archiving the repo (which disables new commits, new issues, etc) would have served the same goal and not wasted the time of the larger community. Here's an example from one of my own archived projects. Is there any doubt in your mind as to the state of this repository? https://github.com/karunamon/concourse-resource-bitbucket https://github.com/karunamon/concourse-resource-bitbucket Inconveniencing countless others in a fit of pique is a pretty good definition of immature, petty behavior.

deleted 7y ago

[deleted]

bornelsewhere 7y ago

This. The project is considered one of the (if not the) go-to web frameworks in Rust, lives under its own organisation, is promoted and discussed by many other people. It's not a sole property of the maintainer any more. The maintainer does not owe anyone any new code, nor accepting any PRs. But he does have to set correct expectations. If you want to be the sole BDFL and not care about others opinions or contributions then don't promote it as production code, keep it under your own profile, and/or make it clear in the README. Now it's a community project, "fun" is not necessarily the most important quality anymore. State your position early.

deleted 7y ago

[deleted]

Skunkleton 7y ago

> bear the blunt It's "bear the brunt".

carapace 7y ago

("bear the brunt" It's one of those weird words that only exists now in that phrase. Brunts are borne but otherwise unmentioned. It's kinda like how you can be over- or underwhelmed, but never just whelmed.)

jimmydorry 7y ago

Why should a project author dictate in what contexts their project can be used? It's on the coder to manage their dependencies and ensure they are a good fit for their needs... not the project author. And what exactly are you contributing to this project author to match your demands of them immediately fixing flaws that are found?

egdod 7y ago

>people who already volunteer their time for my benefit have to follow my rules when doing so Ok.

awb 7y ago

> you either be receptive to security concerns or you clearly label your project as a toy project. Or, assume all OSS projects are toy projects unless stated otherwise. Usually the serious ones offer a support license for a fee, or are supported financially by companies. Otherwise, it's just someone building cool stuff for free. Also, it's probably fair that most OSS maintainers aren't marketing their projects too aggressively outside of a blog post or a Reddit submission. When they take off, it's usually other developers hyping them and that hype usually comes from being lightweight, easy to configure or super fast. It's not until a project has been hyped by the community do people start trying to put it into production and looking into security issues.

ssokolow 7y ago
I think that https://actix.rs/ https://actix.rs/ counts as an implicit "the author doesn't intend this to be seen as a toy project" in people's eyes.
- mwcampbell 7y ago
  One thing that nobody here seems to have mentioned is that, as far as I can tell, the actix.rs website was not created by the author of Actix itself. Just compare the writing on the website with the author's own postmortem. I don't know who wrote the website; I can't find an author's name or a Git repo for the site itself. But whoever they were, it seems that they, not the author of Actix itself, did the marketing that gave many of us our primary impression of what kind of project this is. If anyone reading this knows more about the history of the website, I'd appreciate any additional background or pointers to more details. Edit: After running some git blame commands on the https://github.com/actix/actix-website https://github.com/actix/actix-website repository (thanks Nikolay for keeping it there), it seems that the most eloquent marketing for the project was written by Armin Ronacher. I'm sure this was all done with Nikolay's permission, since it's under the actix GitHub organization, but my point is that Nikolay himself didn't say the things that have been quoted from the website, and they didn't necessarily reflect his own attitude about the project. So that might have caused some confusion.